Get a new phone? Consider your Fifth Amendment rights

Late last month, citing the seizure of “various electronic devices and documents” in a filing in U.S. District Court in Los Angeles, longtime President Trump attorney Michael Cohen said he would invoke his Fifth Amendment rights not to incriminate himself in a civil case brought by adult film star Stormy Daniels.

The Fifth Amendment of the U.S. Constitution bundles together many rights, among them the right to refuse giving testimony that would prove that you had committed a crime. This protection extends not just to requested testimony in a courtroom during a trial, but also to any time an authority asks a person to write or say something that could be self-incriminating. And it often extends to the requested decryption, or unlocking, of a computer that potentially holds evidence of a crime, as in United States v Boucher.

So could a U.S. court require you (or Cohen) to enter a password to unlock a computer in its possession so that prosecutors could review its files for evidence of a crime? The answer varies, but in most cases, you could successfully invoke your Fifth Amendment-protected rights in refusing to do so.

What if you’re asked to unlock your phone, which you’ve secured with a fingerprint or facial identification? While that scenario might seem quite similar, many courts would treat it quite differently, declining to extend Fifth Amendment rights to you.

Why? How? Because your biometrics—your unique physical attributes—are rarely seen as testimonial, or something you write, say, or type. And your testimony, or a direct response to a request or demand from or within a court, is protected by the Fifth Amendment; things you’ve already written down or otherwise “confessed” are not.

So if you pen a confession and store it in a safe you own, and the police then obtain a warrant for that safe, you could assert your Fifth Amendment rights not to say or write down the combination that would unlock the box. However, you couldn’t assert your Fifth Amendment rights, if police managed to crack the box open, to prevent them from reading the confession.

As with many new technologies, when a Fifth Amendment dispute over a biometric unlock lands in court, judges must decide how to apply precedent, almost all of which pertains to written or oral testimony. Cases involving new consumer technology are often reasoned by analogy or extrapolation: Postal mail’s addressed envelopes translate to email headers; written letters translate to the body of emails.

Speaking and writing are generally protected by the Fifth Amendment as testimonial acts. In most cases today, writing translates to typing, or entering a password. And it does not translate to unlocking a device with your fingerprint or face, which doesn’t require a verbal or written statement.

The Supreme Court first held that the compelled exhibition of the body’s characteristics was not testimonial under the Fifth Amendment in Holt v. United States. The court explained that it would be an “extravagant extension of the Fifth Amendment” to prevent a jury from hearing a witness testify that a prisoner, who was compelled to put on clothes, did so, and that the clothes fit him.

In a 2016 column for The Washington Post, University of Southern California law professor Orin Kerr laid out an excellent set of scenarios in which he would find a biometric unlock to be a Fifth Amendment-protected testimonial.

If police were to obtain a warrant for a particular person’s phone, then obtain a phone they weren’t certain belonged to the person in question, acknowledging ownership of it by unlocking it on demand with a biometric unlock would amount to “testimony that says, ‘yes, this is my phone,’ or at least, ‘yes, this phone was set to recognize a part of my body as a means of access,’” Kerr wrote. “It further says: ‘I am familiar enough with this phone to know that the fingerprint reader was enabled and which part of me was used by me to program the fingerprint reader.’”

On the other hand, he wrote, if an authority “orders a person to place a particular finger on a particular phone’s fingerprint reader,” the Fifth Amendment “is not implicated here because the person is not testifying…The police could force him to put the finger on the fingerprint reader if he were asleep or otherwise unconscious. No testimonial statement from the person is implied by the act of placing his finger on the reader.”

With forensics tools like Greyshift now likely able to crack four- and six-digit PINs on iPhones, security experts are encouraging consumers to use biometric locks, which are far more hack-resistant. (Another more protective alternative, long word-based passwords, are much less practical to re-enter throughout the day.)

Biometric locks can offer strong and fast, and thus incredibly convenient protection to vast reams of personal data stored on devices. But largely because of their typing-free convenience, they offer less protection today (legally, at least) than passphrases or codes.
The situation at the United States’ international borders is, of course, even more nuanced.

While U.S. citizens and legal permanent residents have a right to enter the country, that right isn’t extended to the items they possess. Immigration officials can search their devices or other luggage, and the 11th Circuit recently rejected the notion that the Fourth Amendment requires “a warrant or probable cause for a forensic search of a cell phone at the border.”

At border checkpoints, for example, Customs and Border Patrol officers are authorized to request that travelers unlock their devices to prove that they’re not explosives. And while U.S. citizens may refuse to do so, invoking their Fifth Amendment rights, CBP officials could consider such a refusal as suspicious. They could confiscate the device and send it to a forensics lab, or simply refuse to permit the device to enter the country.

Technological advancements shouldn’t compromise constitutional rights. And although most consumers are less likely than Michael Cohen to have to worry about self-incrimination, nobody should have to study case law before configuring their phone security.

But until courts reliably rule that biometric unlocks deserve the same Fifth Amendment protections as PIN or passcode unlocks, we all should think twice.