Touch ID, Face ID, and the Evolution of Passcodes, Biometric Security, and the Law
As the release of the iPhone X looms in the near future, the tech community is buzzing with excitement about the variety of new features included on the new model. In particular, Face ID has been a particularly popular topic of conversation. For the uninitiated, Face ID is facial recognition based security system, which will be released on the iPhone X. Face ID is Apple’s latest step in its use of biometrics as a component of device security, following the success of Touch ID, a fingerprint based security system. However, many are showing concern about the functionality of Face ID, as evidenced by its imperfect unveiling, as well as underlying concerns of using one’s face as a security measure.1 Among the more functional concerns, another less common concern is the lack of legal protections granted by Face ID compared to those of a traditional passcode.2
As smartphones become more and more ubiquitous in everyday life, their involvement in criminal investigations has become more and more common. With the introduction of Face ID, on iPhones alone there will be three methods of unlocking a phone, passcodes, Touch ID, and Face ID. While the experiences of an end user may only differ slightly between the three, the use of biometrics instead of a memorized passcode is becoming an increasingly heated battle in the legal community. In the case of a phone containing possibly incriminating evidence, it appears that the method of securing it is key to whether the Fourth Amendment applies or the Fifth Amendment applies.
As of now, courts seem to be in agreement that being ordered to unlock a phone via fingerprint is governed by the Fourth Amendment rather than the Fifth Amendment3 In these cases, the vast majority cite Commonwealth v. Baust, where the court made the distinction between being compelled to provide a passcode as opposed to a fingerprint.4 The Baust court describes the difference providing a passcode as an incriminating testimony coming from memory, and unlocking via a fingerprint as physical evidence.5 In this way, the Baust court influenced several other jurisdictions in their interpretation of what rights each means of security entails.
However, not all jurisdictions agree. In State v. Stahl, Florida’s Second District Court of Appeals ruled that passcodes are not protected by the Fifth Amendment.6 Citing Doe v. United States, the Stahl court states that providing a passcode doesn’t “betray any knowledge [Stahl] may have about the circumstances of the offenses’ for which he is charged” and does not “relate a factual assertion or disclose information.”7 While it may be a stretch to say that a disclosing a passcode is not disclosing information, it is certainly up for debate whether or not providing a passcode in and of itself betrays any knowledge of the circumstances of any offenses.8
Russell Brandom, The five biggest questions about Apple’s new facial recognition system, The Verge (Sept. 12, 2017), https://www.theverge.com/2017/9/12/16298156/apple-iphone-x-face-id-security-privacy-police-unlock [https://perma.cc/5LV3-KDEH].↩
Adi Robertson, Why Face ID won’t give you the legal protection of a passcode, The Verge (Sept. 12, 2017), https://www.theverge.com/2017/9/12/16298192/apple-iphone-face-id-legal-security-fifth-amendment [https://perma.cc/D4HE-Q478].↩
See In re Application for a Search Warrant, 236 F. Supp. 3d 1066 (N.D. Ill. 2017); see also State v. Stahl, 206 So.3d 124, 135 (Fla. Dist. Ct. App. 2016); see also Commonwealth v. Baust, 89 Va. Cir. 267, 268 (Va. Cir. Ct. 2014); see also Matt Hamilton & Richard Winton, The government wants your fingerprint to unlock your phone. Should that be allowed?, L.A. Times (Apr. 30, 2016), http://www.latimes.com/local/california/la-me-iphones-fingerprints-20160430-story.html [https://perma.cc/Q6NZ-5W5A] (citing a search and seizure warrant allowing the search of an iPhone, unlocking it with Touch ID).↩
Baust, 89 Va. Cir. at 268.↩
Stahl, 206 So.3d at 135.↩
Stahl, 206 So.3d at 134 (quoting Doe v. United States, 487, U.S. 201, 210, 215 (1988).↩
While facial recognition is more closely related to fingerprint scanning than a passcode, a major consideration for the future is whether or not technology has fundamentally changed how the Fifth Amendment should be applied. In Justice Stevens’ dissent in United States v. Doe, Justice Stevens famously wrote that an accused may “in some cases may be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe[,]” but as technology advances and our keys become fingertips and our safe combinations become facial expressions, does this distinction still matter?[footnote]Doe, 487, U.S. at 219.↩