For the first time in the world, law enforcement officials have used Apple’s Face ID security system to unlock a suspect’s iPhone. FBI officials armed with a search warrant forced Ohio resident Grant Michalski, who was charged with possessing child pornography, to put his face to his iPhone in order to unlock it, allowing them to investigate its contents.
This case has led to questions about the legality of the cops’ actions. Typically, the Fifth Amendment protects US citizens from self-incrimination, which prevents law enforcement from forcing suspects to provide information like the passwords to their devices. Federal officials have had difficulty obtaining passwords because of this.
Even Apple cannot provide passwords to users’ devices and it has refused to build a loophole into its security. This led to a highly publicized legal clash between the iPhone maker and the FBI in 2016 over Apple’s refusal to help the agency decrypt the San Bernardino shooter’s iPhone. The FBI eventually hired a third-party Israeli firm Cellebrite to unlock it.
“Big picture, a warrant is required for the search of a device except in certain circumstances at the border,” said Greg Nojeim, director at the Center for Democracy & Technology, to Wired.
But the protections may not extend to fingerprints and face identification, which courts have not yet defined as self-incriminating testimony.
“For the issue about whether you can be compelled to provide your fingerprint or your face, so far the courts are ruling that fingerprints and faces are not testimonial, and therefore there isn’t a Fifth Amendment violation,” Nojeim said. “In terms of whether compelled disclosure of a password is a violation of the Fifth Amendment, the majority of courts are saying it is.”
This distinction has led to a bunch of cases in which federal agents have been authorized to force suspects to unlock phones using biometric identification.
In 2016, police were authorized to search a property in Lancaster, California and “depress the fingerprints and thumbprints of every person who is located” within the premises.
And now, with the proliferation of facial identification, police have an even less intrusive means of unlocking phones and accessing all the information contained within.
“It’s not at all surprising to me that this happened. In fact, it seems as though Face ID opens up less invasive ways for police officers who have authority to access data on a phone,” said Boston University law professor Ahmed Ghappour, regarding the Michalski case. “There might be less intrusion and physical coercion with forcing a faceprint versus a fingerprint.”
The Supreme Court has not yet weighed in on whether suspects are protected against compelled biometric decryption, so it is possible that such measures will be ruled violations of the Fifth Amendment in the future. In such a case, the question could hinge on whether your face qualifies as a piece of knowledge.
“Arguably if law enforcement says use your finger to unlock, the knowledge of which finger [will unlock an iPhone] is still an item of knowledge being produced by the individual,” attorney Fred Jennings explained to Forbes “Whereas with Face ID, by design it will only unlock with a very specific and obvious and body part.”
In lieu of biometric decryption, however, federal agents have developed other means of breaking into devices using third-party software and hardware like Cellebrite and Graykey, a relatively cheap service that can reportedly unlock two iPhones in minutes. This may spur tech companies like Apple to adopt even stronger security protocols to close loopholes.
In any case, the best form of security seems to be keeping a strong six-digit password on your iPhone.