A magistrate judge in the Northern District of California recently held that compelling people to use their fingerprints, facial recognition, or “any other biometric feature” to unlock electronic devices is a violation of the Fifth Amendment’s protection against self-incrimination. According to the order, use of biometric features to unlock electronic devices is “testimonial,” and, therefore, the government cannot compel it. If that reasoning becomes widely adopted, the government will face significant hurdles to accessing data on smartphones and other devices.

Court holds biometrics are testimonial for purposes of the Fifth Amendment.

At issue in the Oakland, California case was a warrant application by the government to search the residence of two suspects in an extortion investigation. As part of the application, the government sought approval to compel “any individual, who is found at the Subject Premises and reasonably believed by law enforcement to be a user of the device, to unlock the device using biometric features.”1

The magistrate judge rejected the government’s request on both Fourth Amendment and Fifth Amendment grounds. Analyzing the request under the Fourth Amendment, the court found that the warrant failed to provide probable cause to compel “any individual” — rather than just the two targets of the investigation — to unlock electronic devices found in the residence.

Looking to the Fifth Amendment, the court went further to hold that even for the two suspects, for whom there was probable cause to search their electronic devices, compelling them to unlock those devices was unconstitutional. Noting that the Fifth Amendment protects against the government compelling self-incriminating testimony, the court held that the use of biometric features, like a thumbprint or facial recognition, is a “testimonial” act.

The court determined that the use of biometrics is testimonial through two lines of reasoning. First, because biometrics are used in lieu of passcodes and because passcodes are considered “testimonial” under the Fifth Amendment, the use of biometrics is testimonial as well. The court next reasoned that the act of unlocking an electronic device with a biometric confirms possession and control of the device. In other words, the biometric essentially “testifies” that the person has sufficient control over the device to have entered his or her biometric as a passcode and, therefore, has sufficient control over the contents of the device.

The court used those two lines of reasoning to distinguish cases holding that requiring a person to provide blood samples, fingerprints, or handwriting samples, or to stand in lineups, does not violate the Fifth Amendment. The court explained that unlike those examples, which also make an individual the source of incriminating evidence, the use of biometrics to unlock a digital device is “communicative” and, therefore, subject to Fifth Amendment protections.

Application of the Fifth Amendment to biometrics is unsettled.

The magistrate judge’s decision is not without detractors. Orin Kerr, a law professor at the University of Southern California, asserts that the use of biometrics cannot be testimonial because the act of placing a finger, thumb, or face in front of a scanner to unlock a device is not “communicative.” According to Kerr, the fact that the biometric may disclose that the person controls the device is an evidentiary issue, not a testimonial issue. He further reasoned that the fact that the biometric is used in place of a passcode similarly does not make it testimonial.

At least two courts have approved a government request to compel suspects to use their biometrics to unlock digital devices. In State v. Diamond, the Minnesota Supreme Court upheld the trial court’s order requiring the defendant to use his fingerprint to unlock his phone. The state appellate court, whose ruling was affirmed, reasoned that being ordered to produce his fingerprint did not require the defendant to “disclose any knowledge he might have or to speak his guilt.” A district court in D.C. similarly held that the use of biometrics was not testimonial, explaining that “there will be no revelation of the contents of the Subject’s mind.”

On the other hand, in In re Application for a Search Warrant, a magistrate judge in the Northern District of Illinois refused to approve a warrant with a nearly identical provision. Like the California judge, the Illinois judge invoked the Fifth Amendment, similarly arguing that the use of biometrics was testimonial and categorically different from providing fingerprints or blood samples.

The Supreme Courts has grappled with applying constitutional protections to new technologies.

The Supreme Court has recently tackled how to ensure constitutional protections apply to new technologies: warrantless GPS tracking in 2012 in United States v. Jones, warrantless searches of cell phones incident to arrest in 2014 in Riley v. California, and warrantless collection of cellphone tower records in 2018 in Carpenter v. United States. In each of these cases, the Supreme Court instituted limits on the government, requiring it to get warrants in light of the breadth of information available through the use of the new technologies.

The Supreme Court has not yet addressed the biometrics issue. The Riley decision suggests, however, that the Court may be sensitive to the breadth of information available from smartphones. In Riley, the Court observed that “many of the more than 90% of American adults who own a cell phone keep on their person a digital record of nearly every aspect of their lives.” A challenge to compelling a person to provide biometrics to unlock a device would examine how the Court’s concern about the breadth of information accessible from modern digital devices translates to the Fifth Amendment’s prohibitions against self-incrimination.

The government is also reacting to new technologies.

While the biometrics issue winds its way through the lower courts, the government is also responding to the development of new technologies, especially the growing spread of encrypted digital devices. The tension between encryption and access by law enforcement broke into the public discourse in 2016, when the FBI asked Apple to help it decrypt the iPhone of an individual who had shot 22 people in his workplace in San Bernardino. In a 2017 speech, in which he called out Apple for failing to engage in “responsible encryption,” Deputy Attorney General Rod Rosenstein stated that “thousands of seized devices sit in storage, impervious to warrants.”

No doubt in part a reaction to the spread of encrypted devices that may be impossible to decrypt — and likely seeing an opportunity in the growing use of biometric security for digital devices — the government has taken a different tack: a new policy to include provisions in search warrants authorizing agents to compel the use of biometrics.

What this means for you:

  • Companies should counsel their employees not to provide the government with biometric information unless compelled to do so by a warrant. If a person consents to providing the biometrics to law enforcement, it will be difficult for counsel to later mount a constitutional challenge to any information obtained as a result of the consensual unlocking of the device.
  • As the biometric debate continues, companies should evaluate their policies governing the use of phones or other devices for work purposes and consider whether to require employees to use passcodes instead of biometric security. Such a change may help protect company data from being accessed by the government in the event of a search warrant.
  • Companies should make clear to employees that they have no expectation of privacy in the digital devices provided to employees or in the company files on a personal smartphone used for work purposes. Smartphones and cell phones often include key pieces of information when a company is undertaking an internal investigation; a policy clearly stating that work information on devices is not private may avoid refusals by employees to cooperate.
  • If your company or its employees is served with a warrant of any kind, contact counsel as soon as possible.