If You Want to Keep Your Phone Contents Secret, Perhaps Don’t Use a Fingerprint Lock

Your fingerprints are both information that identifies who you are and can be used as evidence from crime scenes. They are also, now, cybersecurity tools that allow you to lock away information from snoops, be they hackers or government agents.

While citizens have the right to avoid self-incrimination, prosecutors are legally permitted as part of the investigation of a crime to do things like collect your fingerprints and DNA samples, with a court order. That information may nevertheless incriminate you if it’s attached to a crime scene.

Now that fingerprints can be used to secure smartphones, they can be used to get a whole lot more information about the person other than confirming his or her identity. So can a citizen be forced to use his or her own fingerprint to provide access to information that could be more incriminating than just their physical location? Is sticking your finger on a phone an act that should be treated the same as punching in your passcode?

For the latter, prosecutors have had a difficult time attempting to force citizens to give up their codes because it would potentially be incriminatory compelled speech. Thus we have the foundation for the current iteration of the encryption fight to try to force tech companies like Apple help law enforcement bypass their own security.

But for the fingerprints, so far judges seem to be more inclined to treat it like an order to provide a house key or essentially the way they’ve been treating fingerprints thus far. In two cases, judges have ordered citizens to use their fingers to open a phone to let investigators review the content.

It’s a complicated issue for legal experts. The Los Angeles Times spoke to a couple of them:

Even with the limited outlines of the inquiry, [law Professor Susan] Brenner said the act of compelling a person in custody to press her finger against a phone breached the 5th Amendment’s protection against self-incrimination. It forced Bkchadzhyan to testify —without uttering a word — because by moving her finger and unlocking the phone, she authenticated its contents.

“By showing you opened the phone, you showed that you have control over it,” Brenner said. “It’s the same as if she went home and pulled out paper documents — she’s produced it.”

But Albert Gidari, the director of privacy at Stanford Law School’s Center for Internet and Society, said the action might not violate the 5th Amendment prohibition of self-incrimination.

“Unlike disclosing passcodes, you are not compelled to speak or say what’s ‘in your mind’ to law enforcement,” Gidari said. “‘Put your finger here’ is not testimonial or self-incriminating.”

But consider this idea: The government can get a warrant to search your home. If you refuse to cooperate, they can force their way in. Citizens can passively resist a search warrant of a physical location (or actively resist and get themselves arrested), but it doesn’t stop police from carrying out the search. This is not remotely the same situation, and treating it as though a fingerprint is just another type of “key” is ignoring the issue that the police can’t simply force the matter when the suspect refuses to cooperate.