In a potentially landmark decision, a California federal judge ruled that authorities cannot force you to unlock your smartphone with your fingerprint or face. The ruling is being heralded as a huge win for privacy by privacy and legal experts, going further to protect citizens’ private lives from government searches than any before.
The magistrate judge for the U.S. District Court in the Northern District of California, Kandis Westmore, argued that a person’s fingerprint, face, or any other biometric features used to unlock a device should be considered equivalent to a passcode, and therefore biometric features are testimonial under the Fifth Amendment. Her judgement builds upon the Securities and Exchange Commission v. Bonan Huang decision from 2016, which ruled that authorities cannot force people to give up their private passcode to unlock their device.
Therefore, Westmore surmised, authorities can’t force you to unlock your phone with your face or fingerprint because that would constitute a violation of your Fifth Amendment rights, which protect you against self-incrimination (you cannot be compelled to testify against yourself).
“Even if probable cause exists to seize devices located during a lawful search based on a reasonable belief that they belong to a suspect, probable cause does not permit the government to compel a suspect to waive rights otherwise afforded by the Constitution, including the Fifth Amendment right against self-incrimination,” Westmore writes in the ruling.
Previously, U.S. judges had ruled that police were allowed to force unlock devices like smartphones and laptops with biometrics, such as fingerprints, faces or irises — despite the fact that authorities were not permitted to compel a suspect to divulge his or her passcode to unlock the device. However, according to the new ruling, all login security methods are equal.
Westmore’s decision was issued in the denial of a search warrant for an unspecified property in Oakland. The warrant was filed as part of an investigation into a Facebook extortion crime, in which a victim was threatened with the public release of an “embarrassing” video unless he or she pays a ransom. The detectives had some suspects in mind and sought the warrant to raid their location, as well as a seizure of personal property, including access to open up all mobile devices on the premises via facial recognition, a fingerprint, or an iris.
While Judge Westmore agreed that investigators had shown probable cause to search the property, they were denied blanket access to open all devices inside by forcing unlocks with biometric features. The request was struck down as “overbroad” by the judge, claiming it was “neither limited to a particular person nor device.”
But in a more significant part of the ruling, Westmore declared that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices with their biological features. Previously, courts had decided biometric features, unlike passcodes, were not “testimonial.” That was because a suspect would have to willingly and verbally give up a passcode, which is not the case with biometrics. A password was therefore deemed testimony but body parts were not, thus were not granted Fifth Amendment protections against self-incrimination.
According to Electronic Freedom Foundation (EFF) Staff Attorney Jamie Williams, the decision strengthens fundamental privacy and constitutional principles despite technological advances.
“It’s important that courts are looking closely at how searches of digital devices affect our constitutional rights,” she said. “This has implications not only on law enforcement’s ability to lawfully search a phone, but also on law enforcement’s ability to force people to unlock their phones and thereby serve as witnesses against themselves. As Magistrate Judge Westmore correctly recognized, given the sheer amount of data on modern day cell phones, the government simply cannot anticipate the full contents of someone’s phone, and any order compelling someone to unlock their phone — whether via a numeric passcode or a fingerprint scan— violates the Fifth Amendment privilege against self-incrimination.”
The ruling echoes SCOTUS’ Carpenter v. United States ruling from June 2018, which determined that finding the physical location of a cell phone without a warrant violates the owner’s Fourth Amendment rights.
Unlike previous rulings, the court is mandating that faces, fingerprints, and irises be treated like the other technological means of unlocking the device, such as a password, pattern or PIN, as they are serving the same function and therefore should be regarded as the same under the Fifth Amendment.
The government will likely appeal the decision in district court, as it creates a split among the courts about whether faces or fingerprints are likewise testimonial. The circuit courts are already in disagreement over whether a phone’s passcode is considered to be testimonial.
The government may argue that unlike a password, a fingerprint is not something you intentionally communicate, but rather a feature of your body and the use of such a feature to gain access to information is not testimonial like being compelled to say something is.