Earlier this week, Forbes reported that it had uncovered the first known case of law enforcement forcing a suspect to unlock their iPhone X using facial recognition technology. On August 10th, FBI investigators served a search warrant on 28-year-old Grant Michalski, a Columbus, Ohio, resident who would later be arrested on child pornography charges; the warrant allowed the officers to seize and search Michalski’s iPhone X, and when he was told to face the device’s selfie camera, through which Face ID operates, he complied.
Ultimately, according to Forbes’ review of the case, the phone didn’t prove to be all that helpful to Feds case after all. While investigators were able to manually search the phone and took photographs of the contents, they weren’t able to keep the device open long enough download its data or conduct a forensic examination. Once the phone was locked again, reopening it would have required Michalski’s passcode; the Fifth Amendment of the Constitution guarantees his right not to give that up.
“Law enforcement can’t get a warrant to bypass the Fifth Amendment’s right against self-incrimination,” Clare Garvie, a fellow with Georgetown Law’s Center on Privacy and Technology, tells RR-Magazine. “Historically, passcodes cannot be compelled because in disclosing the information, the defendant would be acting as a witness against themselves.”
When Apple introduced Touch ID, which uses fingerprint recognition technology, along with the iPhone 5S in 2013, it’s appeal to consumers was its speed and discretion, making it a more convenient security measure, but not necessarily a more secure one. Face ID replaced Touch ID when the iPhone X was released last September; the phone’s “TrueDepth” system uses the selfie camera and a bunch of sensors to create and store a hyper-detailed 3D facial map which becomes even more refined with time.
In 2014, the Supreme Court ruled in Riley v. California that phones with biometric locks are protected against unreasonable search under the Fourth Amendment. That means law enforcement needs a warrant to not just seize the phone, but to gain access to its contents. Compelling a suspect to give up their faces or fingerprint has not been interpreted by the courts to be a violation of the Fifth Amendment, because while pass-codes are regarded as “testimonial,” fingerprints and faces are considered performative or identifying, and thus exempt from Fifth Amendment protection.
““It’s really important for people to realized that Touch ID and Face ID aren’t security measures,” says Garvie. “They’re convenience measures. And now there’s this distinction being drawn between passcodes and biometric unlocking devices. Conceptually, it’s strange, because if we were talking about a safe inside someone’s home, one would analogize a biometric lock to any other type of lock.”
“It shouldn’t surprise us that as we continue to expand and reinterpret the Fourth Amendment and the Fifth Amendment to new technology, that there will be these weird divides that might make us think twice about what protections should be applied and whether we actually need affirmative, explicit laws to protect our privacy as new technologies develop,” Garvie says. “And I think this is one of them. The distinction between protections afforded a passcode and protections a biometric lock seems very arbitrary to me from a personal information protection perspective.”