Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones
forbes.com
forbes.com
Really though, this descent into a police state is such a pathetic outcome for this country. Dangerous, scary, and tragic, but also... pathetic. This is what happens when a sizeable majority don't even participate in the electoral process, and those who do are overwhelmingly mindless.
Relevant bits start at page 5 (III - LEGAL DISCUSSION).
Compelling a person to provide his or her fingerprint does not
implicate, let alone violate, the Fifth Amendment. "[B]oth
federal and state courts have usually held that [the Fifth
Amendment] offers no protection against compulsion to submit
to fingerprinting."
Schmerber v. California, 384 U.S. 757, 764 (1966).
That is so because the Fifth Amenmendment privilege against self-
incrimination only prevents the use against an accused of
testimonial or communicative evidence obtained from him.
That seems to me to be a very reasonable thing to say. It seems to me that we have plenty of mechanism in place to say "you have X, you can use it for Y, and not Z, because using it for Z violates someone's rights". As a super contrived strawman example, if your computer ever gets confiscated by law enforcement, while they may be permitted to search it, they can't just play Fallout 4 or mine bitcoins on it.
Another instance I think is similar in concept: juries are instructed to disregard things (i.e. pretend they don't have a piece of information for the purposes of a trial) all the time, when access to this information would be improper.
If they could, they would read your mind too.
The Department of Justice is saying that a fingerprint is more like a key than a password I guess. Or alternatively that unlocking phones is search and not testimony.
The EFF seems to be primarily objecting on the grounds that a search of "all devices in the building" is too vague to be a correct warrant.
[1] http://www.uclalawreview.org/the-fifth-amendment-encryption-...
The self-incrimination clause of the fifth amendment is broadly interpreted as intended to dissuade the government from attempting to coerce confessions. Forcing someone to unlock their phone with a fingerprint caries none of the moral hazard of forcing them to testify.
All of that being said, I'd love for US society to recognize that a search encompassing a bunch of people's phones is vastly more intrusive (by virtue of the volume of data collected and network effects) than a search of a building that excludes computing devices, and for us to require a correspondingly higher burden of proof.
If you don't want anybody to be able to take your stuff, don't make it possible for somebody to take your stuff. A piece of paper saying something isn't permitted is not going to stop it happening.
It's no different, really, then that they can force you to press your fingers onto a sheet of paper for booking during an arrest, or to take a buccal swab.
What they apparently cannot do is force you to admit what if any finger of your would unlock the phone. Apparently some people use tricks like locking the phone with a knuckle or even the tip of their nose (that one sounds comical). Really though, it goes to show that the good old fashioned memorized password has not gone out of style. Any biometric or dongle-based authentication or encryption can be circumvented by legal process.
And in a civil matter, judges and parties have even more power. Ultimately, if a court is convinced that you know a password and are not properly invoking a 5th amendment privilege against criminal self-incrimination, you could be held in contempt (fined daily, or jailed) until you provided the password or the password-protected materials. At this point it could well become a battle of wills and proofs, which the contemnor may well lose.
They authenticate who you are, they aren't trivial to fake. However, they shouldn't authorise access to a device on their own. Your fingerprint works as a somewhat more secure, medium term swipe-to-unlock for your phone.
I understand once you've authenticated who the user is, authorization is just a mask of what they are allowed to do. It is like saying "after you've given your username (GMail account) to Google, it should allow you to read your email. If you happen to be an administrator for Google Business account you can also see other accounts or settings etc".
So hopefully you meant that you just use your fingerprint in place of typing out your username not in place of typing your username _and_ password.
(Somehow similar to sudo which asks for the user's password the first time but assumes that the logged in user is allowed to execute further sudo commands without pw auth. Even if sudo does not really implement two different user roles here.)
That might be your best hope.
(Respectfully submitted, etc, etc.)
Just so I'm clear, I'm saying I find this interesting because in many cases we are talking about the same people who were alive in 1989. In the USA you can say "Oh, that generation believed in those things, but those currently alive don't believe in these things." (I don't agree with that statement, but you could make that argument.) Whereas in Poland, it's in many cases the same people who fought for a more open system who are now tolerating the drift towards a more authoritarian system.
To me, the story isn't about "overwhelmingly mindless" voters, its about voters who are angry with the failure of the system. That is, they are mindful of how the system has failed. They may not know what the answer is, but they are angry, and they are willing to elect politicians who seem to mirror their anger. It might be a bad strategy to vote for someone simply because they appear to reflect your anger, but I think I can understand the motivation, and it is not quite the same as being mindless.
In actuality, maybe people are just voting based in whether their economic circumstances improved over the last term, regardless of whether the change was due to national or global factors. Maybe they just don't like the Russians and voted for the nationalist rhetoric.
I'm still calling "mindless".
If the US were to outlaw all forms of encryption, we would have less privacy AND less security:
Less Privacy: all communication is now readable by a third party in the middle
Less Security: all banking information is now transmitted in plaintext
They're burglars, not masterminds.
Wish I had some better sources. All I could find from a quick google search is that the market rate for full personal info is $20 -- that is certainly something you can get with email inbox access (which is enough to get Amazon login which would have your full address etc etc)
Keep in mind most services only needs your email address and browser cookies for full access, only banking services etc are 2FA.
I only lock my phone in case it's lost or stolen, I don't lock it to keep the government out of it, since pretty much everything on my phone is available in Google's Cloud services (except for my password protected password manager), which the feds can gain access to with a valid search warrant.
The general public is mindless to the extent of surveillance and the aggregation of that data, the vast majority are certainly unaware of the possible unintended consequences of wanton disregard for the 3rd, 4th and 5th amendments. Only a third of Americans can even name all three branches of government, to believe they're informed on matters they don't understand on a technical or philosophical level is badly overestimating the American Public.
The 'actual problem' seems to be in the selection/delegation process. The minority that is currently in charge has framed the question as that of "safety and security" vs liberties ("freedoms"). The corporate media (aka "journalists" and "free press") is more than happy to support this thesis. The "people", lets be frank here, were never expected to be a nation of Jeffersons. And it is unreasonable to expect them to be astute techno-political scientists carefully weighing various implications of technology and policy.
Other unelected minorities -- corporations such as Apple, Google, Facebook, ... -- could by fiat choose to only offer goods that preserve our liberties. They chose not to do so and arguably they are not under an obligation to do so. (Note arguably.)
Other unelected minorities -- technologists that work for the above -- have also elected to lend their talents to produce these systems, platforms, and devices that erode our liberties. Again, arguably they don't really have much choice in the matter, as we all must pay the proverbial rent.
So, imho, beyond the cliche that 'a people deserve their government' (which is a congenital defect of a political body), there remains the framework that was intended to select the best and brightest minority that would be entrusted with carefully considering various options. It is this framework that is currently broken. I accuse our so called "free press" for a playing a substantial role in the dysfunction of our political system.
There are other responsible parties for sure, but the press and media play a critical role in knowingly confusing and frightening the majority -- a role known as agitprop in the USSR.
[edit: noop cleanup]
The free press is not objective, or benevolent, or ethical. Yes, parts of it may have started that way, but today's free press is merely free, in that it can and will say anything, within legal bounds. It ends up saying whatever gets the most eyeballs.
We need a better way to disseminate factual information to the public. Sadly, I have no idea how to do that.
https://theconversation.com/ has African, Australian, French, UK, US and global versions (but the African, US and global editions seem not to be donor-funded), Creative Commons licensing, and no advertising (but it does have sponsors).
I wonder how it would cope with a billion readers.
Elected, yes. Thoughtful and responsible depends on your point of view. For example: there is a substantial contingent of people in the U.S. that want the country to be a Christian theocracy. (Most of these people believe that this is how things used to be, and they want to return to those halcyon days.) And so, unsurprisingly, these people vote for representatives who they think will advance that goal. So, for example, is Roy Moore "thoughtful and responsible"? If you're a member of this contingent then you probably think he is. If you're not, then you probably don't.
Likewise, there is a substantial contingent of people who are scared witless at the thought of terrorism, and think that it's worth trading in the odd civil right to insure that terrorists are not "free" to plot our destruction unmolested. There is a substantial contingent of people who are unrepentant racists who think black people are less than human and the root of all evil. Likewise for Muslims. All of these people not only don't care when "the bad guys" have their civil rights violated by the cops, they think it's a feature. They see the cops as courageous defenders of their point of view against the corrupting influence of pluralism and wussiness. The vaguaries of our electoral system make a difference at the margins (e.g. by gerrymandering) but none of these things would be possible if there were not millions of people who thought that it was good and proper.
The irony is that by blaming the system instead of acknowledging that the outcomes we see are the result of democracy working exactly as intended you are actually contributing to the problem, which is that everyone retreats into their echo chamber and spends their energy vilifying anyone who doesn't agree with them instead of working constructively to figure out how all 7+ billion of us are going to get along on this little planet.
But I am not blaming the system.
I pointed out bad faith actors in the system, which in my view, are contributing to the dysfunction of the process, and have poisoned political discourse in this nation. I don't remember the exact date when we crossed the threshold but do remember noting a somewhat abrupt introduction of extreme vulgarity and uncivility into televised political shows at some point in 90s.
https://en.wikipedia.org/wiki/Telecommunications_Act_of_1996
The various POVs you mention are noted and point well taken. But were not these strains of thought present in the 80s, 70s, and before? I haven't watched TV in decades, but the few times I am exposed to it by force (visits to family, public spaces, etc.) my skin literally crawls, regardless of which point of view is being voiced. It's like the planet of the vulgarian apes. Don't you think the public that is exposed to this /garbage/ day after day has been conditioned to act in the same manner?
> Likewise, there is a substantial contingent of people who are scared witless at the thought of terrorism, and think that it's worth trading in the odd civil right to insure that terrorists are not "free" to plot our destruction unmolested.
This is the only POV that I find unacceptable. This view -- propagated from on high from -- is the factual "blaming the system". The clear subtext of this manufactured view is that our system is fragile and inadequate in face of enemies and needs corrective measures that alter the very nature of our system. Yes, the people were scared, but it was not the people who pulled the Patriot Act out of God knows where and passed it without even an attempt at deliberation.
They could have been offered other remedies, but were not. They could have been reassured by national leadership that we can prevail without disfiguring our national character, but were not.
Americans torturing and torture shows on cable TV.
Disgraceful.
Honestly, I've been finger-wagged out of an opinion or two, so "never" is too strong. Frankly, I challenge you to name any form of "political discourse" that regularly changes opinions. In my experience political discourse in general rarely accomplishes anything other than preach to the choir and cause opponents to dig in.
You were certainly wagging your finger at a fingerwagger.
You wrote:
> The 'actual problem' seems to be in the selection/delegation process.
That sounds like blaming the system to me.
(In case you're interested, Pierre Sallinger touches on the post '72 role of the media in the selection process in his 1995 c-span interview: https://www.c-span.org/video/?67372-1/ps-memoir [edit: jump to 44:56])
> The 'actual problem' seems to be in the selection/delegation process.
One has long suspected the insidious idea that the Founders etc. did such a Good Job that we mustn't criticize any current incarnation of the institutions and traditions they created. One used to hear this silly idea from "strict constructionists", but recently it seems to come mostly from devoted supporters of the status quo.
I'm sure part of the reason non land owners, slaves, women, etc. were not allowed to vote was in order to keep a certain group in power, but there have been many writers who correctly predicted what happens when everyone is allowed to vote:
"A democracy can only exist until the voters discover that they can vote themselves largess from the public treasury."
The fact that you have something like 1/2 the citizens working and subsidizing the other half, along with our 24 hour news cycle that cannot be trusted anymore than Pravda at its worst, and I think we will probably look back and realize allowing everyone a vote is a bad idea, or no better than a monarchy or some other rule by a select few.
Not that I have a better idea, though
What states include being educated as an input to their voter eligibility determination?
(Anybody got ready access to med school cadavers with the fingerprints intact?)
Unless by rubber hose cryptanalysis. Still better than being compelled to produce one's finger, though ;)
The government is on a "fishing expedition" -- obtaining a warrant to search the phones so that they can (hopefully) find evidence. As mentioned in the article, it doesn't work that way (they're going about it backwards).
Your GPS location data is another good one. Hypothetically speaking, would you really want the public, which contains some seedy characters mixed in with the "normal" people, to see the route you take to drop off/pick up your daughter at school, making her easy pickings for a kidnapping?
There's more than just the websites you browse and the people you talk to on your phone. It's a digital vault of every move you make, every question you ponder, every person you've interacted with, every store you shop at. Your banking data is there, your stocks, your hobbies, your bursts of anger, your outlook on life, your loved ones' and associates' addresses and contact information.
In short, you hurt more than yourself by exposing your private data, whether to the public at large, the government, or commercial entities seeking to hoover it up for advertising revenue. It's your responsibility to keep it private.
Depending on who is in power in your area, that could change very quickly. If you're of the wrong race, someone like Donald Trump might use three-letter agency-collected data to move you out of the country. Foreign states might want to use your identity to get cheap health care for their citizens.
Immigration policies, substance legal statuses and acceptable social practices and attitudes change overnight. Someone could spam with you child pornography and border officials could find it in your phone at the border.
Furthermore, you don't know what you're going to do with the rest of your life and how the decisions you make now could be perceived in the future.
Maybe someone's watching your house, keeping track of when you're not home. Or maybe they're using your phone patterns to do the same: Checking your phone when you're in the gym, in the bathroom at a restaurant.
And any of these scenarios could be used to threaten you or someone you care about. Did a neighbor ask if you could babysit their children when they're away? Did your aunt admit she has a mental disorder that could get her fired? Did a friend reveal he has a substance abuse problem? Did your elderly parents send you copies of official financial documents to review? Ever looked for a "questionable" book on Amazon?
Furthermore, if you're not following proper safety practices, you could be a liability for future business partners. Who wants to risk sharing data with someone who's loosey-goosey about the info on their systems?
In conclusion, it's not just you, right now that bears thinking about. It's everyone in your social circle over the long-term future.
The police asks you to surrender you phone. Telling "you have nothing to hide, you shouldn't mind" and you respond with "It is not up to decide if I have something to hide"
Or, your friend is arguing for letting the police see their phone because your friend has nothing to hide. Your friend says "I have nothing to hide". But you respond with "It is not up to you if you have nothing to hide, so you shouldn't have that attitude".
Assuming you meant the second, what is the reasoning behind it?
It's not implausible.
I'm not saying I personally agree, I'm saying I can respect it.
At least, if they can't unlock the phone, then they even have to worry about the evidence they fabricate as you might have something that counters it on the phone.
If the authorities are seeking to blame or frame or shame... suddenly you have everything to hide.
I do not carry a phone though.
These reference what can be requested/forced during court proceedings. Do you have any examples that support the statement you made?
Sadly, I disagree. If I'm in a foreign country and I want legal advice I'll ask the local bar (or equivalent) about my rights. I'm simply not going to unlock my phone or incriminate myself just on the word of law enforcement.
I don't do anything criminal, this is about respect. If they feel I have done something wrong it's for them to prove it. I'm not going to do it for them.
How will you contact the local bar equivalent in this situation?
Even without the time pressure of a connecting flight, you're not exactly going to tell the police "hang on, wait until I google to see who I should contact, and then let me give them a call. Then I will see if I will comply with your order or not"
I know it's a snarky question because there is no way to phrase it without being so; but I honestly don't understand the reasoning behind 'convenience features are worthless/I turn them off because they're not 100% secure against [some powerful actor] that might hypothetically want to look at my phone'. I mean, they can get comms metadata from carriers; speech comms content from wiretaps; email content through subpoenas (minus those you encrypt with client-side tools, a major pain to do on a phone anyway). If you're going to run a coke line from South America or plan to overthrow the government or conspire to bomb immigrants, you're better off not using any such obvious electronic communication tools in the first place. So what's your reasoning?
He may not be someone the government is interested in right now, but as is clear in the case we all are discussing, the government is on a fishing expedition, seeking to unlock a non-suspect's phone in the hopes of making a suspect out of them. That's some 1980s USSR shit right there, and it's disheartening that our government is trying to become what they once fought against. They can get a warrant first, or they can get bent.
To put it another way, you don't want your neighbor poking around in your garage looking for something she can report to the fire marshal "just because", even though you're pretty sure there's nothing she can call out, so you keep your garage locked.
"If you've got nothing to hide..." - right?
> I mean, they can get comms metadata from carriers; speech comms content from wiretaps; email content through subpoenas (minus those you encrypt with client-side tools, a major pain to do on a phone anyway).
All of those things need to have their case present in front of a judge. And that is infact a major difference.
"Cao told Quartz that the spoof worked on the iPhone during an earlier attempt, but it didn’t work when he tried to replicate the result for the technical report. “We unlocked it at the start of the project, but when we prepared the report, I could not unlock the iPhone. I used the same protocol and method. I’m not sure why it didn’t unlock,” Cao said."
I wouldn't exactly say this was a slam dunk then, eh? Seriously I'd like to know if someone can reproduce the exploit on film using non-exotic materials or process (ie, no latex glue or pre-existing high-resolution images). Of note, if feds can get fingerprints through existing paperwork, why do they need a seek a warrant for this?
It's less work if the judge will approve it.
> For that reason, the warrant authorizes the seizure of ‘passwords, encryption keys, and other access devices that may be necessary to access the device,’” the document read.
So the "power off the device, now it's a password" seems to be something they were prepared for. The article is unclear as to whether or not this was granted, but if so it'd be seemingly unprecedented.
The first thing that comes to mind for me is the Apple patent on recognizing a fingerprint anywhere on the phone's surface, and using that in combination with Android-style lock screen patterns. A lock screen pattern isn't nearly as secure as a full password, but it could serve a similar legal role.
[p.s. this should be relatively trivial to roll out in a patch by Apple.]
There may be 4th and 5th amendment arguments, too
Philosophically and legally I am firmly convinced that we should treat information, and therefore data, as an extension of consciousness. Information is only meaningful because we have the conscious capacity to interpret it; digital data is a "memory aid", a tool we use to expand our everyday capacity to interact with information. Data is not analogous to a physical object; any discussion about ownership, or transfer rights (and so forth) is inherently based on a flawed premise.
Directly descendant from that argument is that privacy is irrelevant, that instead, individual agency is what matters. Privacy is a decision not to share information, but that means privacy is only possible given the agency to make that decision. Any serviceable definition of information agency implies, at the very least, having control over the creation, retention, and sharing of data, which is so much more than privacy. And when you start looking at it that way, it becomes clear that our conversations around incidents like OP's link should happen around the fifth amendment, and not the fourth.
When I talk to tech people about this, they (typically) emphatically agree. When I talk to lawyers about it, their response is much less enthusiastic: "That's an interesting perspective, but it's not really supported by existing case law." If all we're doing is piling technical circumventions on top of bad policy, we're stuck in an arms race. What we need is a shift in legal attitudes towards information; that's the only sustainable outcome here. We need a cogent legal and philosophical argument, one rooted in existing, accepted principles, that makes a solid case for a new paradigm surrounding data.
This would also help them remember their pin which people can forget amazingly easily... It can be weeks between using it on iOS.
Counterexample popped in my head was parents with a belt asking for iPhone unlocked. Still has respectability, law, and order in most places. I wonder if there are other counterexamples.
They can be fooled reasonably well (well enough to fool an iphone) with pretty simple techniques. For details, search for a bunch of articles from 2002 referencing Tsutomu Matsumoto's work.
> it can't be recorded by cameras
Well... http://www.theregister.co.uk/2014/12/29/german_minister_fing... https://news.ycombinator.com/item?id=12611155
Or a configurable timeout, rather than the apparently hard-coded 48 hours.
Or ask for a PIN if the phone's radio detects many more other radios in the vicinity than a few minutes ago ("Because you might be under duress, please enter a PIN now.")
Or if a phone has been sitting on a flat surface for a while, require a PIN.
Or require a PIN if the phone is tapped with a duress code ("Shave-and-a-hair-cut"). Could be pretty subtle.
Countermeasures like this are useful both against thieves (who might want to unlock your phone and get access to your accounts) as well as against state actors (ditto).
So... how often are you actually in a situation like that? You know, police with a search warrant.
Or, do you feel that there is a reasonable possibility that will happen to you?
Also, how does that work? Customs officer asks you to touch-unlock your phone.
You say, no I have a pin code!
And then they say, oooh then, nevermind, please proceed?
That does not make sense.
I'm not sure if fingerprint scanners have been defeated using ink prints yet, but it's just a matter of time, I suspect.
Fingerprints are established as identification, which makes them necessarily not private/secret.
;)
> For that reason, the warrant authorizes the seizure of ‘passwords, encryption keys, and other access devices that may be necessary to access the device,’” the document read.