Why Fingerprints Are Actually Less Secure Than Passcodes

Photo courtesy of Pixabay
Photo courtesy of Pixabay

 

By Kady Enright, Staff Writer

On May 9, 2016, the U.S. Attorney for the Central District of California filed a Memorandum in Support of Search Warrant Application regarding a warrant that compelled any person on the search premises, at the time of execution, to provide depressions of his or her fingerprints. The prints would then be used to unlock any fingerprint sensor-enabled device discovered by law enforcement during the search.[1] I.e., a device like a smartphone.

According to Forbes, the warrant was executed, but the warrant itself and other documents related to the case are not publicly available.[2] In its memorandum, the government asserts that no Fourth or Fifth Amendment violations would occur through the warrant’s execution.[3]

Attempting to negate the possibility of a Fourth Amendment violation, the government states that “[b]ecause there is probable cause sufficient to seize the digital device, there is probable cause sufficient to seize ‘the key’ to that device in the form of a person’s fingerprint.”[4] This is not the first time the government has compelled a person to provide his or her fingerprints to unlock a device. Nevertheless, it may be the broadest authorization to do so yet, as it could apply to “every person on the SUBJECT PREMISES.”[5]

Permitting a search with such broad and intrusive terms could be overreaching. Without more information on the search, however, it is impossible to conjecture about whether probable cause or reasonable suspicion would extend to each person subjected to fingerprinting during such a warrant’s execution.

Interestingly, if the devices were not fingerprint sensor-enabled, and instead simply locked by a password or passcode, the information therein would likely be outside the reach of law enforcement. In Virginia v. Baust, the Second Circuit determined that compelling a suspect to produce the password to a device would be a violation of the Fifth Amendment, but compelling his fingerprint to access the device would not.[6] The basis for this conclusion is that a passcode is considered “testimonial evidence,” while a fingerprint is not.[7]

This then begs the question of whether there is really a worthwhile distinction. Based on the same amount of evidence, should law enforcement be able to access the data on the smartphone of suspect A because he uses a fingerprint scanner — but not suspect B if he only has a passcode? Arguably, by providing a fingerprint to unlock a device, the suspect is constructively authenticating that the potentially incriminating contents belong to him. Yet, this would not be considered self-incrimination.

Is this reasonable, or is this an example of one of the ways in which the law is struggling to keep up with technology? In Riley v. California, the U.S. Supreme Court discussed at length the vast amount of information contained in smartphones and held that such devices cannot be searched by law enforcement incident to an arrest without a proper warrant.[8]

In the case of the California warrant calling for everyone on the premises to provide fingerprint depressions, it is unclear how specific the warrant was in detailing which devices would be seized and what information would be sought. But without more precise terms, it is difficult to reconcile such a broad authorization with a case like Riley.

Perhaps this is an issue more appropriate for the legislature to consider. In the meantime, keep in mind that your privacy on your smartphone may be best served by using a passcode as opposed to a fingerprint scanner.

 

Sources


[1] Thomas Fox Brewster, Feds Walk Into a Building, Demand Everyone’s Fingerprints to Open Phones, Forbes (Oct. 16, 2016), http://www.forbes.com/sites/thomasbrewster/2016/10/16/doj-demands-mass-fingerprint-seizure-to-open-iphones/#4f56c7a48d9d.

[2] Id.

[3] Id.

[4] Id.

[5] Viginia v. Baust, 2014 WL 10355635 (2nd Cir. 2014).

[6] Id.

[7] Id.

[8] Riley v. California, 134 S.Ct. 999 (2014).

Comments are closed.