Feds: It's legal to demand fingerprints to unlock phones of everyone in a building

The government claimed that it is legal to enter a building and demand everyone's fingerprints, passwords, encryption keys to unlock all phones.

fingerprint
Credit: Thinkstock

Whether you were in your house, or visiting someone in another house or even an apartment, you would surely not believe that cops could bust in and demand the fingerprints and thumbprints of every person there that they suspected might own a smartphone with a fingerprint sensor. That’s right, not accused of having committed any crime, but of simply owning a smartphone which can be unlocked with fingerprint biometrics. Nevertheless, in what is believed to be a first, that is exactly what a court filing in California asked for.

Federal prosecutors wanted to search a location in Lancaster, California. A May 2016 memorandum in support of a search warrant asked for “authorization to depress the fingerprints and thumbprints of every person” who was at the location so long as law enforcement “reasonably believed” the person used a “fingerprint sensor-enabled device.”

EFF senior staff attorney Jennifer Lynch told Forbes that the EFF had “never seen anything like this.”

The location is simply referred to as the “subject premises.” The actual warrant or other documentation was not available to the public. If the “subject premises” were a house, then the search would cover every person living there or happening to visit at the wrong time; the mass biometric scanning would be even worse if the location were an apartment building.

Collect-it-all mentality

The memorandum states:

While the government does not know ahead of time the identity of every digital device or fingerprint (or indeed, every other piece of evidence) that it will find in the search, it has demonstrated probable cause that evidence may exist at the search location, and needs the ability to gain access to those devices and maintain that access to search them. For that reason, the warrant authorizes the seizure of “passwords, encryption keys, and other access devices that may be necessary to access the device.”

Not only was the government unsure about who might be at the “subject premises,” but it also had no way of knowing “which fingers or thumb of which person(s) would unlock the device.” Yet prosecutors pointed out that “in any event all that would result from successive failed attempts is the requirement to use the authorized passcode or password.”

“They want the ability to get a warrant on the assumption that they will learn more after they have a warrant,” criminal defense attorney Marina Medvin told Forbes. Apparently the government hoped waving around a warrant would be enough to “induce compliance by people they decide are suspects later on. This would be an unbelievably audacious abuse of power if it were permitted.”

There was also no way to know what phones might be there; the memorandum specifically mentioned Apple, Motorola, HTC and Samsung phones having a fingerprint sensor before honing in on Apple and its Touch ID feature.

Government swept aside Fourth and Fifth Amendment rights

When faced with such a demand to hand over biometric information, password and encryption key which would completely open your smartphone, surely you would be protected from unreasonable searches and seizures by the Fourth Amendment, or even from self-incrimination by the Fifth Amendment?

But the government swept aside those rights, arguing that neither applied.

“Compelling a person to provide his or her fingerprint does not implicate, let alone violate, the Fifth Amendment.” The prosecutors then cite cases to support that as well as noting that “the Fifth Amendment protects the accused, and as of this point, no person is being accused.”

Regarding the Fourth Amendment, law enforcement would only collect biometric data from people believed to have a phone which could be unlocked with a fingerprint. Fingerprinting, they argue, is permitted so long as there is “reasonable suspicion that the suspect has committed a criminal act.” Everyone at the location with a smartphone surely could not be suspected of committing a criminal act?

“That’s not how the Fourth Amendment works,” Medvin said. “You need to have a reasonable basis before you begin the search—that reasonable basis is what allows you to search in the first place.”

Lynch too expressed concern to Forbes which first uncovered this memorandum to mass-scan everyone with modern smartphones at a location in order to bypass security that locks phones. “If this kind of thing became law then there would be nothing to prevent…a search of every phone at a certain location.”

To express your thoughts on Computerworld content, visit Computerworld's Facebook page, LinkedIn page and Twitter stream.
Windows 10 annoyances and solutions
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.