Reg comments46

US judge halts mass fingerprint harvesting by cops to unlock iPhones

Uncle Sam's vaguely worded raid warrant knocked down by the Constitution

warrant

Analysis An Illinois judge has rejected a warrant sought by the US government to force everyone in a given location to apply his or her fingerprints to any Apple electronic device investigators happen to find there, a ruling contrary to a similar warrant request granted last year by a judge in California.

Under current law, the government already has the right, given sufficient evidence, to compel a specific individual to unlock an electronic device protected by a fingerprint reader like Apple's Touch ID sensor.

In 2014, a judge on Virginia’s Second Judicial Circuit ruled that a defendant could be forced to provide a fingerprint but not a passcode, the distinction being that a fingerprint is not testimonial whereas a passcode is.

Defendants thus cannot use the Fifth Amendment's protection to refuse to provide a fingerprint on the grounds that the fingerprint itself qualifies as self-incriminating testimony.

But the government's right to compel action diminishes when it lacks sufficient cause to make such demands of people, at least in Illinois.

In his order this month, M. David Weisman, a magistrate judge for the US District Court for the Northern District of Illinois, notes the government wants a warrant that isn't limited to a particular person or device. The warrant also lacks information about who is believed to be involved in criminal conduct and the specific Apple device involved.

Essentially, prosecutors want to go into a vaguely described location – perhaps a home or an office – and make every inside, regardless of who they are, provide their fingerprints to unlock their Apple handhelds so investigators can rifle through the devices for evidence. The warrant doesn't say where this raid will take place nor exactly who is targeted.

The government's cause in Illinois may be easy to support – the warrant is part of an investigation involving the sexual abuse of multiple victims by someone associated with the premises in question and the trafficking in child pornography over the associated internet connection. But its methods present legal issues that go beyond this specific case.

The judge accepts that the Fourth Amendment – which protects against unreasonable searches and seizures by the government – does not protect fingerprints.

But in this case, the judge wrote in his order, "the government is seeking the authority to seize any individual at the subject premises and force the application of their [sic] fingerprints as directed by government agents."

Such a broad intrusion does have the Fourth Amendment implications and is not justified based on the facts presented, the judge said. Perhaps more significantly, the judge allows for Fifth Amendment considerations as well, despite his observation that "the government is generally correct that the production of physical characteristics generally do not raise Fifth Amendment concerns."

While being forced to produce a fingerprint isn't itself unconstitutional – authorities can take fingerprints from those they arrest – Weisman explains that Fifth Amendment comes into play when the compelled production of information itself is incriminating.

The critical distinction comes down to how much the government already knows. Where the information to be gained is largely known – a foregone conclusion – then the law favors the government. But where the information is unknown or incriminating, the Fifth Amendment weighs more heavily.

'With a touch of a finger, a suspect is testifying'

And in this case, Weisman asserts the government is asking for too much, with too little evidence to support its demand. "By using a finger to unlock a phone's contents, a suspect is producing the contents on the phone," the judge wrote. "With a touch of a finger, a suspect is testifying that he or she has accessed the phone before, at a minimum, to set up the fingerprint password capabilities, and that he or she currently has some level of control over or relatively significant connection to the phone and its contents."

This view, if accepted by other courts, would offer more protection to data on electronic devices. However, Weisman is careful to note that the Fourth and Fifth Amendment obstacles to granting the government's warrant request may be overcome with more specific information.

EFF Staff Attorney Andrew Crocker in a phone interview with The Register said: "This is exactly what we hope courts will do, which is when faced with a situation like this to consider the implications of granting a request and to reject the ones that are too broad."

Crocker said that the judge was rightfully concerned by a warrant application that relied on boilerplate. Investigators, he said, "didn't know they'd find a phone and didn't have any reason to assume an iPhone would be found."

The warrant application's reliance on dated boilerplate – it cites BlackBerry devices as common digital assistants – is problematic, the judge wrote, because it means recent technological developments, like wireless internet service, are not addressed. He suggests the government has not shown that it can rule out the possibility that the person involved in transmitting unlawful images might have accessed the network in question without authorization.

Pointing to the California ruling last year that granted a similar warrant, Crocker expressed concern such broad, non-specific warrants are becoming common practice.

Crocker said that while the Illinois judge's decision is not precedent-setting, it's likely to be scrutinized by other magistrate judges reviewing warrant demands in other jurisdictions. ®

Sign up to our Newsletter

Get IT in your inbox daily

Biting the hand that feeds IT © 1998–2017