Biometric Facial Recognition for Unlocking iPhone — Does it Violate the Fifth Amendment?
This writing was originally posted in NYU Journal of Intellectual Property & Entertainment Law (JIPEL) on 9 March 2019, as accessible through https://blog.jipel.law.nyu.edu/2019/03/biometric-facial-recognition-for-unlocking-iphone-does-it-violate-the-fifth-amendment/
With the overwhelming numbers of criminal mischief, the government seems to seek resourceful leeway that may lead to the findings of valuable evidence in an investigation. Among all feasible scenarios, there is a possibility for the law enforcer to request access to the criminal offender’s cell phone locked with latest facial biometrics technology, including the technology of Face ID introduced by Apple. Apple’s explains that Face ID revolutionizes authentication by utilizing the advanced technologies to map the geometry of its users’ face and therefore allowing customers to securely unlock their iPhone using a simple glance.
Recently in August 2018, FBI compelled Grant Michalski, an Ohio resident, to unlock his iPhone X with Face ID. As investigated by Forbes, “a federal investigator told Michalski to put his face in front of the phone, which he duly did.” Through this forced act, FBI was able to access the contents of his iPhone, including saved images in the “photos” album used by Michalski in Kik Messenger to engage on his sexual interest with other offenders. So far, this could be the first case recognized that enables the usage of forced Face ID in a criminal investigation. If this forced use of Face ID was conducted with a proper warrant — which indeed the warrant was served in this case — then it is plausible the investigation will not bring salient polemic because it has aligned with the Fourth Amendment. However, the questionable idea arises on whether or not it would violate the Fifth Amendment indicating that no person “shall be compelled in any criminal case to be a witness against himself.”, or usually known as the principle against to the self-incrimination.
The gambit on the interpretation of the “self-incrimination” was made under the Fisher v. United States (1976), whereby the Fifth Amendment is only applied when a defendant is forced to make a testimonial communication that is incriminating. As stated by the judge from the case of Doe v. United States (1988), “testimonial act” can be interpreted when an accused’s oral or written communication, or act, explicitly or implicitly, relates to a factual assertion or disclose information. The examples include complying with a subpoena to produce documents as it would implicitly communicate “statements of fact.”. However, it is pertinent to note that an act is not “testimonial” when the act provides “real or physical evidence” that is used “physical characteristics”.
With regard to Face ID, up to this date, the US Supreme Court has neither made any particular decision regarding the utilization of Face ID in a criminal investigation. Nevertheless, similar cases pertaining to other biometric identification, specifically fingerprints, emerges dispersedly through various lower courts decisions. The first relevant case was the 2014 Virginia court opinion under the case of Commonwealth v. Baust. An assault happened to a victim in a bedroom and Baust, as the defendant, was believed to possess a recording device that continuously recorded the purported assault. The police took s Baust’s phone, underlying the action based on the victim’s testimony that Baust’s equipment “could have possibly” recorded the assault and the recording “may exist” on the phone. Yet there is encryption found either through passcode or fingerprint to access the cell phone.
The judge in this case further elaborated and gave distinction on the “testimonial communication” between the production of the passcode and the fingerprints to access a smartphone. The judge said that Baust cannot be compelled to produce his passcode to access his smartphone but he can be compelled to produce his fingerprint to do the same because its creation was voluntary i.e. not compelled. This creation leads to the conclusion that “it would not be protected against disclosure.”. Further, it was said, “like physical characteristics that are non-testimonial, the fingerprint of Defendant if used to access his phone is likewise non-testimonial and does not require Baust to communicate any knowledge at all.”. Whereas the production of password requires Baust to “disclose the contents of his own mind.”.
The similar decision found in Minnesota Supreme Court recently in January 2018 (State v. Diamond). In this case, “Diamond merely provided his fingerprint so that the police could use the physical characteristics of the fingerprint to unlock the cell phone.” It was further stated, “to the extent that providing a fingerprint to unlock the cell phone might require a mental process to unlock the phone, the police did not rely on that mental process here.” (as refer to Hubbel case in 2000). In addition, the Judge compared the fingerprint results that went through fingerprint matching program was similar with the process taken through blood sample which depended on the chemical analysis of the blood, not the act of providing the blood sample.
The abovementioned cases slightly show different treatment for the use of passcode as iPhone unlocking method, as some case precedents in these areas were less murky than the use of fingerprints. As referred to the US vs. Doe case, the act of unlocking an iPhone using passcode will demand the use of contents of the mind and the production of a combination is accompanied by implied factual statements that could prove to be incriminatory and hence be categorized as a testimony. A recently issued case from Indiana Appeals Court in August 2018 also exposes its firm position to the use of passcode as a forced act before the law enforcer. However it is interesting to observe the progressive view of the judge in question, opining the court so far held no Fifth Amendment problem with compelling a person to something that displays a physical characteristic, yet they see “this reasoning is outdated and ironic when compared with the current, heightened, “state of the art” electronic security provided by physical characteristics such as facial recognition and retinal scans.”
This latest decision emerges the idea of how the future judgment and interpretation may be applied to the forced act of law enforcer using Face ID. Considering that Face ID will include the use of the face as physical characteristic to unlock the iPhone, the similar opinion evaluating that the physical characteristic is not a part of testimonial act will have a tendency to prevail.
I personally inclined to the thought that by giving either a Face ID or even a Touch ID, we are actually opening the access to the information inside the iPhone, which will incriminatory to the customer as the data owners. By utilizing the iPhone through Apple Face ID or Touch ID, it will give direct access to its contents and it will touch the functional fashion of the iPhone. Furthermore, in obtaining the data of the iPhone using Face ID, there is less possibility for the creation to occur voluntarily and without compelled action, as assumed in fingerprint case under 2014 Virginia court opinion, because the offender can just be propelled to show and get his face scanned. This action supposedly obtains a stronger position from the law perspective, rather than lose its protection before the law because of the existing cases.
To this extent, it is important for the technology users to understand facial biometrics technology may not deliver the desired safeguards before the law enforcer. However, as similar with the Touch ID, the users may get protection from the disability systems installed by Apple in Face ID, whereby the Apple ID will be disabled and switched to passcode mode if there have been five unsuccessful attempts to match a face. Whereas there may be advantageous possibility derived for this disability system when the investigation happened to an offender, the technology user still needs to consider changing the iPhone protection with the passcode instead of the Apple Face ID or fingerprint to avoid the unexpected exertion of the user’s own cell phone.
