Florida court says iPhone passcode must be revealed | Hacker News Reader

Florida court says iPhone passcode must be revealed

bbc.com

14 pointsColanR14 comments

Eugene Volokh has a deeper analysis:

https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

I was surprised to read that he thinks (and previously thought) this would be the right ruling. My non-lawyer tl;dr is that your passcode isn't "testimony": the government knows the passcode exists and that you know passcode, and therefore it isn't subject to the same protection that would apply to telling the government some piece of information that may or may not exist and is inherently interesting. At the very least, he claims, the government is absolutely in the clear to compel you to enter your passcode and not reveal what it is.

What if the passcode you use is a confession to another crime?

I continue to not be a lawyer, but my guess is the government will make that particular passcode inadmissible as evidence in the second crime, and then demand it for prosecuting the first crime. My impression is the legal system is generally good at Seeing What You Did There and is rarely amused.

See, e.g., Sega v. Accolade, where it turns out that you can't implement a DRM system that consists solely of forcing people to display your trademark, and then sue them for trademark infringement.

doesn't matter, if the police stumble onto incriminating evidence in the course of the ordinary and legal investigation of a crime, it can be used in court.

I imagine it would fall under the same category as the police discovering a dead body in your home while performing a legal, unrelated search (you're going to jail).

Exactly, the key is "testimonial evidence," as in, is the piece of information the government is making you tell them testimonial in nature as defined by case law. Testimonial seems to be defined by case law as giving some kind of real information. . . which to me is a vague standard, I mean, doesn't all communication, aside from incoherent blathering give some kind of information. The court in my reading hasn't really clarified how much or what kind of information has to be given up before becoming testimonial. The supreme court has previously found that signing declarations and consents, (like if they government were to force you to sign a consent to a bank to turn over your banking info), wasn't testimonial because a declaration doesn't communicate any real info. I don't know if the same reasoning can apply to cell phone passwords but they really need a clearer standard.

I would agree with the analysis that "At the very least ... the government is absolutely in the clear to compel you to enter your passcode and not reveal what it is."

As a matter of policy, I can think of three important principles at play:

* If we want encryption that the government and the tech companies themselves cannot decrypt without your consent, then the passcode is the only way to get in.

* The justice system should have a way to see inside locked places if it reasonably believes that there is important/relevant evidence inside.

* The person who might be coerced to give up the passcode is likely the only person who knows the passcode.

I can't think of a better compromise that lets you have all three things without some sort of compromise, and a combination of compelling you to open the box without revealing the passcode as well as some limits on how much the government can examine once inside seems like the best balance.

Exactly. The government can compel you to open a gun safe, and they can compel you to login to your computer. Those are both pieces of "evidence" not "testimony" (or as much as there can be a difference).

Hmmm. I agree with this more than I thought I would have.

I think the real thing here is that the reason to protect against self-incrimination is really a protection against abuses of the justice system, against the ability for judges to force false confessions out of people. If you somehow knew that that a piece of testimony would be guaranteed honest and guaranteed uncoerced, is there still an argument for not requiring you to testify about it, just because it's about yourself?

I think we're left with diafygi's argument about muscle memory, that a suspect may have literally forgotten the passcode and the courts shouldn't be able to say "No you didn't."

Just a small addition, the analysis was done by prof. Orin Kerr[1], who is writing for "Volokh Conspiracy". He writes a lot about the intersection of technology and 4th/5th amendment, etc. I don't agree with everything with him, but it is pretty interesting, and he writes clearly.

1. https://www.law.gwu.edu/orin-s-kerr?id=3568

Whoops, I'm not sure how I failed to see the byline. Thanks for the correction!

Serious question: What if he forgot?

Totally not defending him, but if it's been some time since he had to unlock the device, it's not totally unreasonable for someone to forgot the code to unlock a device.

I change my passwords regularly, and I've completely forgot my password several iterations ago.

If you do passwords as you're supposed to (with random words you memorize). They are very forgettable once you stop having to use them regularly.

That would be a whole different situation from the get go, it would be a fact based question based on credibility. Courts evaluate people's credibility all the time and make determinations of credibility. If a judge believes that you are telling the truth when you say you forgot, he would let you off, if the judge doesn't believe you, then you'd have to go to jail.

My question wasn't as much focused on the get go. But if my device was confiscated and we had many months of legal discourse, and I was then compelled to unlock my device, it's entirely possible that I've lost the muscle memory for the code. Now I run the chance of permanently locking the device by just the sheer amount atrophy of password memory.

Anyway, agree that this hypothetical isn't as relevant to this situation, but compelling someone to give up information they don't actually possess seems like the slope this is slipping down.

Reply on news.ycombinator.com