In January, the United States Court of Appeals for the District of Columbia Circuit ruled in U.S. v. Brown that the FBI violated the Fifth Amendment privilege against self-incrimination when it compelled a man to unlock his phone with his thumbprint. This decision created a circuit split on whether using biometrics to unlock a device violates the Fifth Amendment. The Supreme Court may consider resolving this split, potentially setting a national standard for unlocking devices secured with physical identifiers.
This issue has significant implications for digital privacy as law enforcement has argued that its inability to access locked devices justifies using backdoor access tools. If the Supreme Court resolves this split, its decision could also impact searches of electronic devices at borders. Customs and Border Protection (CBP) officials have broad authority to inspect travelers’ devices without a warrant but cannot force travelers to provide their passcodes.
The recent increase in viewpoint-based immigration enforcement actions raises concerns that individuals targeted for their political beliefs might be coerced into unlocking their devices for searches. The question is whether using your thumbprint to unlock your phone is "testimonial." The Fifth Amendment protection against self-incrimination depends on whether compelled conduct is "testimonial."
The D.C. Circuit applied this test in cases involving three co-defendants implicated in the January 6, 2021 attack on the U.S. Capitol. During the investigation, FBI agents obtained Peter Schwartz's cell phone and compelled him to unlock it with his thumbprint after he failed to provide the correct numeric passcode, revealing incriminating text messages.
Schwartz was convicted and appealed, arguing that compelled unlocking was testimonial and unconstitutional, meaning evidence derived from it should have been excluded. It is well-established that disclosing a passcode is testimonial, but the Supreme Court has not addressed whether using fingerprints or other biometrics is similar.
In April, the Ninth Circuit ruled in U.S. v. Payne that such acts were not explicit communications and required no cognitive exertion, likening them to non-testimonial acts like blood draws or routine fingerprinting. No other circuit has addressed this question.
In U.S. v. Brown, the D.C. Circuit concluded that using Schwartz’s thumbprint was testimonial under both physical trait cases and act of production doctrine because it communicated knowledge about ownership and means of access.
The D.C. Circuit reversed the district court's decision and remanded the case for further consideration while emphasizing reliance on specific facts of this case, suggesting variability in constitutional assessments of biometric use.
While awaiting Supreme Court resolution on this matter, questions arise about law enforcement potentially circumventing constitutional issues by spoofing fingerprints obtained during routine booking or other non-testimonial acts to unlock devices.
Reports indicate successful spoofing methods are intricate and time-consuming with varying success rates across different devices due to different sensors and operating systems frequently updated to address vulnerabilities.
Information from this article can be found here.
