On January 10, 2019, a Magistrate Judge in the Northern District of California issued an order denying an application for a search warrant that would have compelled any individual present at the premises to be searched to unlock their digital devices using biometric features, such as thumb prints and facial scans.  The order is notable in that the search warrant was not rejected on Fourth Amendment grounds, but rather on the grounds that requiring a person to unlock his or her digital device ran afoul of the Fifth Amendment’s privilege against self-incrimination.[1]  Providing a thumb or facial scan, the court reasoned, constituted testimony protected by the Fifth Amendment, analogizing biometrics to passwords that similarly protect information stored on devices.  This decision highlights the current tension in the courts on the accessibility of information stored on digital devices, and the courts’ continuing efforts to develop rules governing this rapidly-evolving area of law.

Background

In In re: Search of A Residence in Oakland, California, No. 4-19-70053 (KAW),  the  Government was investigating two individuals whom it suspected of committing extortion.  According to the Government’s search warrant application, the suspects allegedly threatened their victim over Facebook Messenger, claiming they would release an embarrassing video of him if he did not pay them.  The Government sought a search and seizure warrant to seize items at a residence in Oakland that was connected to the suspects.  Among other things, the Government’s application requested authority to seize all digital devices belonging to any person at the residence at the time of the search and compel their unlocking through the use of biometric features, even in the case of individuals other than the subjects of the warrant.

Magistrate Judge Kandis Westmore denied the application.  In a January 10, 2019 Order, the court found that, while the Government had probable cause to search the premises under the Fourth Amendment, it did not have probable cause to search and seize all digital devices nor compel their unlocking using biometric features because the search warrant application was not limited to digital devices owned or controlled by the suspects.[2]

The court then turned to the more narrow question of whether the digital devices that did belong to the two suspects (as to which there was probable cause to conduct a search) could be forcibly unlocked using biometric features.  It began with the principle, most recently articulated by the Supreme Court in Carpenter v. United States, that the advancement of technology should not be accompanied by an erosion in the constitutional rights of the people, and that courts should vigilantly guard against such erosion.[3]  Specifically, the court pointed to cases finding that a passcode cannot be compelled under the Fifth Amendment because the act of communicating a passcode constitutes the expression of the contents of a person’s mind and is thus testimonial.[4]  Analogizing, the court found that biometric features are the functional equivalent of passcodes when used to unlock digital devices.

The court distinguished the use of biometrics in this scenario to the use of fingerprints or DNA swabs collected in the furtherance of a criminal investigation, which are allowed to be compelled under the Constitution.  In doing so, it observed the far greater depth of potential evidence when biometric features are used to unlock massive digital databases of information, compared to the narrow use of fingerprints and DNA to place someone at a crime scene.[5]  The court also noted that the act of unlocking a digital device using biometric information irrefutably confirms ownership and control over the device and its contents.  The court thus concluded that biometric features, like passcodes, are testimonial and compelling their use to open digital devices would violate the Fifth Amendment privilege against self-incrimination.[6]

Finally, the court found that the “Foregone Conclusion Doctrine” – pursuant to which courts have held that a suspect can be compelled to produce evidence that the Government already knows the suspect has – did not apply because the information on the digital devices “cannot be anticipated by law enforcement” in advance of their seizure.[7]  It further noted that the Government had other options that “do not trample on the Fifth Amendment,” such as obtaining the Facebook Messenger communications directly from Facebook under the Stored Communications Act or a warrant based on probable cause.[8]

On these grounds, the court denied the application for a search and seizure warrant, holding that the Government “may not compel or otherwise utilize fingers, thumbs, facial recognition, optical/iris, or any other biometric feature to unlock electronic devices.”[9]

Takeaways

This decision adds to the considerable uncertainty about when and how the Constitution permits the Government to compel an individual to unlock a digital device.  While the U.S. Supreme Court has not ruled on the issue, it has recognized the complex legal questions that arise from people carrying an immense amount of personal information on their phones at all times, noting in Riley v. California that “the fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought.”[10]

Lower federal courts have reached varying conclusions on these issues.  Last year, Magistrate Judge Jacqueline Scott Corley, also of the Northern District of California, concluded that the Government could force a suspect to provide a password to decrypt his laptop and external hard drive, employing a more flexible approach to the Foregone Conclusion Doctrine: where the suspect’s knowledge of the password (rather than the contents of the device) is a foregone conclusion, the Government can compel the password.[11]  Also, the U.S. District Court in the District of Columbia held last year that the Government may compel a suspect to unlock his digital devices using biometric features, concluding that such information was not testimonial; in doing so, the court acknowledged that “the line between testimonial and non-testimonial communications under the Fifth Amendment is not crystal clear.”[12]  Various state courts have reached different, and often conflicting, conclusions on these and related questions.

In this case, there do appear to be reasonable grounds for a difference of opinion.  The court’s analysis analogized providing a fingerprint or using facial identification to being compelled to provide a password verbally.  Notably, the court’s analysis appears to have turned on the nature and extent of the information that could be accessed using the biometric feature, as opposed to merely the nature of the information that the suspect was being compelled to turn over through the act of providing the fingerprint or facial scan.  That conclusion in some respects points to the extent to which the conclusion may turn on how the question is framed.  It certainly follows if the analysis is on the nature of the information that the Government is able to access.  But it does not necessarily follow if the question concerns the nature of the act the suspect is required to actually perform.  Providing a password requires the suspect to communicate (either verbally or in writing).  Using a fingerprint scanner requires the suspect to physically do no more than what is required to provide fingerprints at a police station, which has been permitted for decades.  And using facial recognition requires the suspect to do nothing at all besides fail to obscure his or her face, which would otherwise be in plain sight.[13]

These nuances underscore how the law pertaining to access to digital devices is struggling to maintain pace with the constant development of new technology.  Chief Justice Roberts noted in Riley that the “smart phone of the sort taken from Riley was unheard of ten years ago,”[14] and Justice Alito’s concurrence observed that, while it “would take many cases and many years to develop more nuanced rules,” during that time “the nature of the electronic devices that ordinary Americans carry on their persons would continue to change.”[15]  Amidst this shifting landscape, courts will continue to grapple with how to update Fourth and Fifth Amendment law to resolve questions about technology that is becoming obsolete faster than ever.

Finally, it is notable that the decision in this case affords somewhat greater protection to a criminal suspect as to whom there has been a finding of probable cause than courts have given to, for example, travelers entering the United States who are not suspected of misconduct.  Under Customs and Border Protection rules, agents can demand disclosure of passwords and review information on electronic devices without any reasonable suspicion or probable cause, and seize the device for inspection if the device owner does not comply.[16]  This is typically considered permissible under federal law due to the “border search exception” to the Fourth Amendment, which is premised on the idea that individuals maintain less of an expectation of privacy at a port of entry to the U.S. than in the U.S. interior.[17]  Unlike Fourth Amendment protections, however, the Constitutional protection against self-incrimination does continue to have force in the border search context.  Accordingly, while the issue does not appear to have been litigated, it appears that the logic in this case would extend equally to border search requests for passwords or biometric device access, and thereby provide a basis on which such access could be declined.  (For lawyers, that raises an ancillary question of whether a lawyer would have a professional obligation to decline to provide such access in order to protect client confidences.  A 2018 New York Ethics Opinion seems to suggest that a lawyer likely would have that obligation).

[1] In re: Search of A Residence in Oakland, California, 2019 WL 176937 (N.D. Cal. Jan. 10, 2019).

[2] Id. at *2.

[3] 138 S. Ct. 2206, 2214 (2018).

[4] Supra, note 2.

[5] Id. at *3–4.

[6] Id.

[7] Id. at *4.

[8] Id.

[9] Id. at *5.

[10] 134 S. Ct. 2473, 2495 (2014).

[11] In re: Search of a Residence in Aptos, California, 2018 WL 1400401 (N.D. Cal. March 20, 2018)

[12] In re: Search of * * * Washington, District of Columbia, 2018 WL 3155596, at *8 (D.D.C. June 28, 2018).

[13] Likewise, it would be an odd rule to hold that the defendant’s presence at trial in a courtroom was “testimonial,” although that presence could undoubtedly lead to identification by witnesses; and no court has so held.

[14] Supra, note 10 at 2484.

[15] Id. at 2497 (Alito, J., concurring).

[16] See U.S. Customs & Border Patrol, Directive No. 3340-049A (issued Jan. 4, 2018).

[17] See U.S. v. Ramsey, 431 U.S. 606 (1977).