I find the ongoing case of someone being jailed indefinitely for refusing to supply a passphrase far more concerning than someone being compelled to supply a fingerprint.
I find the ongoing case of someone being jailed indefinitely for refusing to supply a passphrase far more concerning than someone being compelled to supply a fingerprint.
Even if you /know/ you don't have anything illegal on any of my encrypted devices, it's better to take a contempt of court charge than give up a password...because of what they might /find/ or possible things unrelated to an investigation that they can link to a crime (or what they can then plant).
I thought being compelled to reveal a passphrase was no longer required.
A charge of contempt is still a charge.
You have the right to not divulge information from your mind that would incriminate yourself. In the US this is called the 5th amendment.
The alternative is that people have a right to stop the courts from functioning. Our interests in not having courts that can be easily thwarted probably does outweigh our interests in any single conviction.
It's only forever if you refuse to comply for that long. It is coercive. The justice system does not, because it cannot, ask you to comply. It forces you to comply and it does not take no for an answer or it would not function.
And holding a person is already a separate charge - kidnapping and unlawful imprisonment.
An actual sentence eventually has an end.
Self incrimination protections are there for a good reason. If the person is on trial, then they haven't pleaded guilty - they say they haven't done what they are accused of. If they are in fact innocent, if the court decided to enforce them into provide this information and jailed them for contempt, it would literally be indefinite because they are innocent and cannot provide information on what they don't know!
I guess that's why a key or fingerprint is allowed - it is definitely something that can be used one way or the other. If they key doesn't work, it doesn't work. Same with a fingerprint.
But a passcode - it is not definitive. The defendant may say they don't know it as someone changed it on them. They then type in a wrong code: how are you going to disprove that?
Moreover, what exactly would she be tried for? Do we need a trial to establish that she has in fact continued to disobey the judge's order to unlock the phone?
The courts really don't get to hold someone indefinitely without charging them with something.
Contempt is generally used as a quick and dirty hack for someone disobeying the procedures of the court. Not providing a fingerprint to unlock evidence is WAY beyond that scope and probably should require a hearing and trial.
Now, she could be detained while that hearing is proceeding, but that's different that just being jailed for contempt.
Compelling someone to open a phone with a fingerprint is far from settled law. It should be litigated properly as part of the trial rather than with a "contempt" charge.
In this instance, it is the court that is attempting to end run an unsettled area of the law using "contempt".
In any case, if the fingerprint isn't the same "testimony" as a passphrase, the suspect is not in violation of the law after 48 hours has elapsed, since "uttering their fingerprint" (as I'm choosing to style it) after 48 hours wouldn't unlock the phone any more anyway.
So, you can be compelled to provide a fingerprint, and the use that the fingerprint is put to is outside the scope of 5th amendment protections.
Further, the Supreme Court Justice Clarence Thomas (with Scalia joining) said that the 5th amendment applies to, "compelled production not just of incriminating testimony, but of any incriminating evidence." https://www.law.cornell.edu/supct/html/99-166.ZC.html
The courts' definition of "witness" is what's relevant in addition to "testimony". Is your smartphone a privileged "witness"? I would think that to be the ultimate decision that needs to be made by the Supreme Court, and one that may in fact hinge on what person is next appointed to the Supreme Court.
Say she waits two days. The phone won't be unlocked with a fingerprint now; it requires a passcode, and the court can't compel someone to provide a passcode in the same way that it can compel them to provide fingerprints.
Contempt wouldn't be a valid charge anymore, at that point. If the judge won't recognize that, the prisoner/suspect could appeal.
The above is my understanding of the theory of how it works. Maybe I'm wrong. Maybe it works differently in practice.
It sounds to me like fingerprint authentication is not something a criminal should use if they don't want to get caught. Apparently a passcode is protected under the Fifth Amendment but not a fingerprint. [1]
But it's ridiculous really. All that a criminal needs to do is restart their phone to prevent their fingerprint from being used. And there are good reasons for doing so other than to escape incrimination! And that can be done from the lock screen... Imagine the criminal held down the power off button for three seconds then swiped, is that a crime? Perhaps that falls under spoliation of evidence, but then again how is not giving a passcode not considered spoliation?
Apple should require a user configurable timeout for requiring of a passcode. I'm sure it normally takes more than two hours to interview and charge someone.
1. http://www.macrumors.com/2014/10/31/fingerprints-not-protect...
A contempt charge wouldn't hold any more (probably), but there's probably another charge that would apply, like spoliation of evidence [sorry, realized that you mentioned that charge further down in your comment].
> It sounds to me like fingerprint authentication is not something a criminal should use if they don't want to get caught.
True.
> Imagine the criminal held down the power off button for three seconds then swiped, is that a crime?
It's also not normally a crime for her to mutilate her thumb or for me to wave a knife around if I believe I'm alone and don't intend to harm anyone. Motive and context matter.
> but then again how is not giving a passcode not considered spoliation?
The act of making the fingerprint unusable would be the spoliation, I suppose. Not giving the passcode would be protected under the 5th.
Sounds like intent to harm oneself, which gets one locked up in the loony bin until one demonstrates oneself to be of sound mind.
You know how you can "sudo" and type your password (if you have an account with sudo privileges) and then for a few minutes afterward you don't have to type your password when you use sudo?
Think of Touch ID like that: the passcode is still the thing that unlocks the phone, but once it's been entered you can use Touch ID for a little while, in much the same way that sudo can remember you've recently proved yourself to it. After 48 hours, after a certain number of failed Touch ID attempts, or after any restart of the phone, though, Touch ID stops being available and the phone goes back to only being unlockable via the passcode (Touch ID will only become available after the next time the passcode is entered).
from what I read, the device has to be left in a locked state for 48h.
The "contempt of court" charge basically serves as a court-private time-out box to send people to whenever they can't handle being in court, until they learn to stop, erm, "blocking the cooperative event queue from pumping messages."
It's not that the charge has to be indefinite—but it has to be capable of sticking as long as the trial's progress is halted. The charge should definitely cease to apply if the trial manages to resume through some other route—and especially if it manages to conclude.
Remember, "contempt of court" isn't about malfeasance, either. Experts who lie on the stand are not in contempt. Lawyers who introduce non-cross-examined evidence are not in contempt. Random audience members getting up and saying things during court are not in contempt. It's only when one of these things causes the trial mechanism to grind to a halt, and then the person refuses to yield to let the trial resume, that they are in contempt. It's a process-control mechanism, and in that respect, it's quite necessary.
(That's not to say it can't be abused—especially in smaller courts in non-jury trials. But it has a well-defined good usage, and can't really be redefined without losing that usage.)
Can a court hold the jury in contempt for having the wrong verdict? They used to be able to.
Why would there need to be any place for unfairness to reside in a system?
The rights of protest and speech cannot be the same in courts, even to the same degree as a place like congress or the offices of the executive. (And in those last two cases, the right of speech is also curtailed.) Otherwise, the courts wouldn't be able to function, particularly in the case of an adversarial court system.
As an analogy, years ago I was part of a small alliance in Eve that consistently won battles. But as we were winning, the server would crash and the devs would come in and roll-back the damage we had done.
The courts have a hard enough time as it is functioning. I am involved in a case against an assailant, and I learned that it's very typical for defense attorneys to purposely drag out cases to maximize victim fatigue. The defense attorney somehow has surgery scheduled on the hearing dates. A legal system is very complicated. It's likely to have more loopholes than a software system has bugs. And it's probably a lot harder and more time consuming to fix those.
This is why "contempt of court" exists.
EDIT: I know that complaints about downvotes are not welcome, and it's quite possible that I'm wrong in what I say, but I'd like to be told how rather than just downvoted! My comment was meant to be a constructive contribution.
EDIT 2: Wow, these many replies help a lot! Thanks!
It's hacking to bypass even a trivial password, so similarly it should be unreasonable to compel disclosure of even a trivial password...
They don't need your usename - your phone assumes it's you and only asks for the password... The fingerprint that they're seeking is not a username, it's a crappy password.
There is a trend to use biometrics in place of passwords, which is a convenience feature which compromises security, even though it is often misrepresented as a security feature. (Using biometrics as a second factor helps security, but there is a big difference between "and" and "or" security measures.)
I agree, but then neither are we the courts; and it is precisely the role of the commons to discuss the law as it should be, so that the legislative branch can, hopefully, enshrine that communal wisdom in the law as it is.
It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws.
I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device.
> It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws.
Rather than endorsing or decrying the law, I meant only to suggest that a simple, factual description of the state of the law, while non-controversial, also doesn't address the question of whether the law is appropriate. I am not at all sure that it is; but I am also a naïf in these matters, which is why I appreciate the many users who responded to my request for clarification.
> I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device.
Indeed, I think that the point you make (and generously attribute to me) is a good one orthogonal to any questions of the law; whether the law is good or bad in any particular sense, it is as it is, and will be so enforced, and users should be educated as far as possible about this when choosing whether and how to secure their devices.
Fingerprints and other things like them are 100% non-testimonial. The fifth amendment does not cover non-testimonial evidence (because it only covers being a witness against yourself).
This has been law since the amendment was enacted, was the purpose of it, etc.
So I suspect if you want the law to be something else, your problem isn't even with the courts or judges, it's with the founders :)
It just so happens that, today, the government can compel you to perform a physical gesture that, by proxy, happens to be used as a key on a device that normally accepts a combination. If it's been 48 hours since your finger was last applied to the Touch ID sensor on an iPhone, that "key" doesn't work any more. So, until the fingerprint is accepted by the courts as a "combination" (effectively, that's how the "common man" sees it, and which the courts treat as testimony-by-proxy) rather than a physical gesture (not testimony at all, and currently easily compelled), the only defense one has (if using Touch ID) is to stall for 48 hours.
So let's just both agree we are suggesting the world is a little more black and white than it is.
I would not try to predict what would happen square-on today, given the splits involved.
That was my reasoning.
I'm not bothered by the compelled production of a fingerprint, given the due process of a warrant; I don't see any obvious reason why someone should expect otherwise from the law, nor any right or reasonable expectation this violates, and I don't think the law needs to change in that area.
(I do see other issues associated with fingerprints, such as the retention of fingerprints from non-criminals cleared of all charges, but I don't see an issue that applies to this case.)
I am bothered by (attempted) compelled production of a passphrase. And I see those as significantly different cases.
I thought that fingerprints were to be provided to:
1) establish biometric proof of identity
2) establish the presence of a person in a particular place
3) establish a person handled a particular object
Or does the law establish that the authorities can use fingerprints for evidence in any fashion? Could they use a scan of a fingerprint to etch a fake-fingerprint latex sheet to open your locked device?In my opinion, there is no reason to see imprinting your finger on a sensor used to unlock your phone as anything other than an equivalent form of "testimony", and it should enjoy fifth amendment protection. I don't think it will be long before this exact definition finds its way to the U.S. Supreme Court.
I can't think of a case involving a fingerprint where there's a similar risk since the fingerprint is arbitrary data.
[1] https://en.wikipedia.org/wiki/United_States_v._Hubbell#Summa...
However, when the prosecution has no specific knowledge that the evidence they seek exists, US courts have ruled that the defendant cannot be compelled to decrypt the storage device, since doing so would be forcing the defendant to reveal that incriminating evidence actually exists.
Applying your fingerprint to an iPhone is an act that, without argument, decrypts data on an encrypted storage media, as the act of applying your finger to the sensor instructs the device to retrieve the actual cryptographic information necessary (your passcode/passphrase, plus other hardware-specific data) to access the cleartext of the data.
The more and more I think about this, the more confidant I am that a fingerprint, while "something you have", forces you to disclose, by proxy, "something you know" to your phone.
I guess the question then is twofold: If you have a combination safe that may contain incriminatory evidence, and a safety deposit box that contains only the combination to your safe, can the courts compel you to give them the key to the safety deposit box? And if so, should they be able to?
That's not true. They've been interpreted to be testimonial because they are a part of a chain of events that results in the production of incriminating evidence that the prosecution isn't otherwise independently aware of. If the prosecution can't say "he has plans for the bomb on his laptop, I saw a photo of a detonator before he closed the lid", they can't force you to disclose the password to go looking for it.
Hubbell suggests that "being forced to surrender the key to a strongbox" does not violate the Fifth Amendment. Under spdustin's generalization, the strongbox hypothetical would violate the Fifth Amendment.
Hubbell is based on the idea that providing documents responsive to a subpoena is itself a testimonial act, because it is "necessary for [the Defendant] to make extensive use of 'the contents of his own mind' in identifying the hundreds of documents responsive to the requests on the subpoena." I don't see how the purely physical act of unlocking the phone is similar.
5th amendment.
http://pilotonline.com/news/local/crime/police-can-require-c...
5th amendment appears to be restricted to what you know based on all available rulings thus far. A password would fall under "what you know."