Despite ruling, pro-privacy biometric laws still face long road to change in U.S.

After a federal court ruling uncovered earlier this week sent privacy advocates hearts’ soaring, legal experts say nobody should expect U.S. regulations on forced biometric log-ins to change anytime soon.

The decision, from Magistrate Judge Kandis Westmore of the U.S. District Court for the Northern District of California, focuses on the ability of police to compel suspects to unlock their electronic devices so that they can be searched.

In the case on which Judge Westmore ruled, regarding the search of a residence in Oakland, Calif., police suspected two individuals of sending an extortion message to a third individual over Facebook Messenger, threatening to release an embarrassing video of him, if he didn’t pay them.

While Westmore agreed that the police had probable cause to search the address where they suspected that the alleged extortionists were located, she denied the search warrant request to compel the suspects to unlock their biometrics-protected electronic devices, ruling that the government may not force suspects to unlock phones or computers protected with prints derived from “fingers, thumbs, facial recognition, optical/iris, or any other biometric feature.”

“While securing digital devices is not a novel concept, the means of doing so have changed,” she wrote in her opinion. “Citizens do not contemplate waiving their civil rights when using new technology, and the Supreme Court has concluded that, to find otherwise, would leave individuals “at the mercy of advancing technology.”

Westmore ruled that the contents of the suspects’ devices are protected under the Fifth Amendment protection against self-incrimination because a biometric log-in serves as a technological replacement to the passcode, which is considered testimony, or “the contents of an individual’s mind,” and testimony can’t be compelled.

She also ruled that the government faces restrictions regarding the types of devices it can rummage through. “The government cannot be permitted to search and seize a mobile phone or other device that is on a non-suspect’s person simply because they are present during an otherwise lawful search,” she wrote.

While Westmore’s ruling might give weight to privacy advocates’ arguments in future court cases—possibly even cases argued before the Supreme Court—the decision isn’t expected to change much in the near term. Westmore’s district is low enough in the court hierarchy that her decision could easily be overturned or face other challenges, legal experts say.

Stephen William Smith, a retired federal judge who is now director of Fourth Amendment and Open Courts at Stanford’s Center for Internet and Society, tells The Parallax that “the courts are divided” on biometric-security protections.

“If I had to guess, most judges would’ve gone the other way and not found a Fifth Amendment violation here,” he says. Westmore’s ruling “is not binding precedent on any other court, or any judge in the Northern District of California.”

Brett Max Kaufman, a senior staff attorney, also sounded a tone of cautious optimism about the impact of the ruling.

“In terms of immediate implications, this won’t hold up in district court. But over the last 5 to 10 years, magistrates [like Westmore] have been the leading voices on this stuff,” he says. “It’s probably is just a matter of time that a case jumps through all the hoops you’d need to reach an appellate court.”

Kaufman points out that in the ruling, which he and Smith note follows a 2017 decision regarding a similar situation by a district court in Illinois, Westmore addresses the difference between using fingerprints to identify a suspect versus using a suspect’s fingerprints to unlock their electronic devices. That may be obvious to many tech-savvy people, but most judges have not yet drawn a clear distinction.

“A lot of people in a lot of courts are trying to blindly apply the fingerprint context to this context, and this court was very sharp in recognizing that this isn’t the same,” Kaufman says. But that’s not often the case. In fact, a different judge ruled for the government in a similar, second 2017 biometric-passcode case in the same Illinois court, Smith says.

“A finger or thumb scan used to unlock a device indicates that the device belongs to a particular individual. In other words, the act concedes that the phone was in the possession and control of the suspect, and authenticates ownership or access to the phone and all of its digital contents,” Westmore stated in her ruling. “Thus, the act of unlocking a phone with a finger or thumb scan far exceeds the ‘physical evidence’ created when a suspect submits to fingerprinting to merely compare his fingerprints to existing physical evidence (another fingerprint) found at a crime scene, because there is no comparison or witness corroboration required to confirm a positive match. Instead, a successful finger or thumb scan confirms ownership or control of the device, and, unlike fingerprints, the authentication of its contents cannot be reasonably refuted.”

For Smith, of the Stanford Center for Internet and Society, this is a small but necessary step in the right direction on the “front lines” of law and technology.

“Magistrate judges are very busy, and it takes time to write an opinion and publish it,” he says. “I think it’s important for them to write opinions and explain their reasoning. It helps other judges to weigh the decision, and makes it more likely that these decisions will be appealed—even to the Supreme Court.