Federal, state court rulings on whether biometrics protected by Fifth Amendment get murky

A recent 4 to 3 ruling by the Pennsylvania Supreme Court noticeably declined to address the matter of whether law enforcement and prosecutors can force a defendant to provide his or her bodily biometrics to unlock an electronic device – as opposed to a password that is the equivalent of a person’s thought, and thus protected by the Fifth Amendment.

However, in the case of the application by the federal government for a search warrant for a cellular telephone in United States v. Anthony Barrera, U.S. District Court for the Northeastern District of Illinois Eastern Division Magistrate Judge Sunil R Harjani issued a Memorandum of Opinion and Order that is in stark contrast to the Pennsylvania State Supreme Court’s decision in that it differs by taking a declarative position on whether bodily biometrics can be construed to also be protected by the Fifth Amendment.

As this analysis will show, this murky and ultimately unchartered judicial terrain of whether a person’s physical biometrics can be compelled by law not withstanding Fifth Amendment protection against self-incrimination, will unquestionably – and soon – find its way to the U.S. Supreme Court. This issue will have too because of all the muddied legal rulings and arguments now in the collective judicial pipeline. And, depending on whether a judicial ruling upholds that a person’s physical biometrics shall be duty-bound to be disclosed by a defendant – as opposed to a password — a thing in a person’s mind that the Pennsylvania high court afforded constitutional protection — the ramifications for biometrics as a trusted means for encrypting personal digital storage devices will be far-ranging, legal authorities agree.

Indeed. In January, U.S. District Court for the Northern District of California Judge Kandis Westmore ruled that requiring a suspect to unbolt an electronic data storage device by means of their biometrics would be a violation of their Fifth Amendment right against self-incrimination.

“If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device,” Kandis asserted in her judgement.

“The government … seeks the authority to compel any individual present at the time of the search to press a finger (including a thumb) or utilize other biometric features, such as facial or iris recognition, for the purposes of unlocking the digital devices found in order to permit a search of the contents as authorized by the search warrant. For the reasons set forth below, the court finds that the government’s request runs afoul of the Fourth and Fifth Amendments, and the search warrant application must be DENIED,” she ruled.

On October 24, 2018, a ruling on a Petition for writ of certiorari to the Circuit Court for the Seventeenth Judicial Circuit, Broward County, Florida, maintained that, “(t)he state here seeks to force the minor to produce the passcode and iTunes password for an iPhone. To do so would be to compel testimonial communications in violation of the minor’s invocation of his Fifth Amendment rights … Additionally, the trial court erred in relying on the foregone conclusion exception, as the requirements of that exception were not met. As such, we grant the minor’s petition for writ of certiorari and quash the order of the trial court.”

However, the ruling concluded by noting, “Finally, because I would conclude that the foregone conclusion doctrine cannot apply to compelled oral testimony, I would go no further. We need not address whether the forced decryption of a device would also violate the Fifth Amendment … That question should be left for another case, one where the state has sought the forced decryption of a device as a remedy.”

In the case of United States v. Anthony Barrera, though, Judge Harjani ruled that “this court holds that compelling an individual to scan their biometrics, and in particular their fingerprints, to unlock a smartphone device neither violates the Fourth nor Fifth Amendment. Accordingly, the court has signed and authorized the government’s warrant, including the authority to compel fingers and thumbs to be pressed on the iPhone home button in an attempt to unlock the device.”

Harjani pointed out that “fingerprinting is a search subject to the constraints of the Fourth Amendment even though ‘fingerprinting … represents a much less serious intrusion upon personal security than other types of searches and detentions.’ The court’s Fourth Amendment inquiry in this case is thus straightforward: does probable cause support the search of the cell phone and the use of Barrera’s fingerprints to unlock the cell phone?”

“The search warrant in this case therefore meets the requirements of the Fourth Amendment,” he ruled,

But, on the matter of the Fifth Amendment, Harjani was much more circumspect. He opined that, “more complicated is the question of whether the forced fingerprint unlock of a cell phone implicates the Fifth Amendment to the United States Constitution.”

He stated that, “Under the Fifth Amendment, the government shall not compel an individual in any criminal case to be a witness against him or herself … Compelling communications or communicative acts can lead to an individual impermissibly bearing witness against him or herself.” He cited Doe v. United States: “Historically, the privilege was intended to prevent the use of legal compulsion to extract from the accused a sworn communication of facts which would incriminate him. Such was the process of the ecclesiastical courts and the Star Chamber—the inquisitorial method of putting the accused upon his oath and compelling him to answer questions designed to uncover uncharged offenses, without evidence from another source.’”

In the opening of his opinion, Harjani observed that “consumers are more often than ever using their biometric information to unlock their smartphones and apps with a fingerprint or face scan. Likewise, the government is responding by seeking authority to compel a subject to use their biometrics to unlock devices found during the execution of a search warrant. Such a request triggers potential Fourth and Fifth Amendment considerations that are addressed herein. Because of the differing views about whether a fingerprint unlock warrant violates the Fifth Amendment among courts, and in particular in this district, the court has issued this opinion to explain its reasoning in this novel area in granting the government’s application for a warrant …”

However, and what could potentially be problematic if just this case alone is taken to the highest court in the land, is that it, too, has a passcode component – not just a biometric security lock – the latter of which the Pennsylvania Supreme Court and U.S. District Court for the Northern District of California ruled is protected by the Fifth Amendment. If five unsuccessful attempts were made to unlock the defendant’s iPhone, the biometric unlock function would be disabled and a passcode required to unlock the device.

In another words, it would require a password the Pennsylvania high court and U.S. District Court for the Northern District of California have said cannot be compelled. As the California court noted, “there are times when [a] device will not accept the biometric feature and require the user to type in the passcode to unlock the device,” thereby invoking Fifth Amendment rights issues. However, the court took the attitude that, “(i)t follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device.”

In the case of the Commonwealth of Pennsylvania v. Joseph J. Davis, the court overturned a lower court’s ruling in a child-pornography case that the defendant could be “compelled” to disclose his [‘64-character’] password in order to allow the Commonwealth access to the defendant’s lawfully-seized, but encrypted, computer.

The Pennsylvania high court noted that the appellant had stated he could not remember his password, “and that, even if he could, it would be like ‘putting a gun to his head and pulling the trigger’.”

The appellant was charged with two counts of disseminating child pornography and two counts of criminal use of a communication device [a personal password protected computer].

On December 17, 2015, the Commonwealth filed with the Luzerne County Court of Common Pleas a pre-trial motion to compel the appellant to divulge the password to his HP 700 computer, but the appellant responded by invoking his right against self-incrimination. On January 14, 2016, the trial court conducted an evidentiary hearing at which several [state prosecutors] … testified … about the investigation supporting the seizure of the computer.”

The state supreme court’s majority stated that “the trial court focused on the question of whether the [appellant’s self-admitted] encryption was testimonial in nature, and, thus, protected by the Fifth Amendment. The trial court opined that ‘[t]he touchstone of whether an act of production is testimonial is whether the government compels the individual to use ‘the contents of his own mind’ to explicitly or implicitly communicate some statement of fact.”

“And for that and other reasons that follow, we find that such compulsion is in violation of the Fifth Amendment to the United States Constitution’s prohibition against self-incrimination,” the supreme court’s majority justices’ ruled, stating that, “as his password exists in his mind, he cannot be compelled to remember the password or reveal it, as a person’s thoughts and knowledge are at the core of the Fifth Amendment.”

However, in a footnote, the majority court’s ruling unmistakably left the barn door open as to whether law enforcement shall compel a person to unlock an electronic device using bodily biometrics, rather than a password memorized in a person’s mind, or, in the eyes of the court, his constitutionally protected thoughts.

The Broward County, Florida, ruling, remember, was similar: “We need not address whether the forced decryption of a device would also violate the Fifth Amendment …”

The Pennsylvania high court opined, though, that, “(b)ecause we are dealing with a motion to require an individual to recall and disclose a memorized password to a computer, in essence, revealing the contents of one’s own mind, we need not address the related, but distinct, area involving biometric features like fingerprints, thumbprints, iris scanning, and facial recognition, or whether the foregone conclusion rationale would be appropriate in these circumstances.”

The court further noted that, “The dissent[ing opinion], however, makes much of the potential for inconsistent results in ‘future cases’ involving these types of biometric passwords. Yet, not only are these communications not before our Court, it is the United States Supreme Court that long ago has created the dichotomy between physical and mental communication. See Holt, 218 U.S. at 252-53 (‘the prohibition of compelling a man in criminal court to be witness against himself is a prohibition of the use of physical or moral compulsion to extort communications from him, not an exclusion of his body as evidence when it may be material’).”

The court also cited, Doe II, 487 U.S. at 210 n.9., which found “the expression ‘more like ‘be[ing] forced to surrender a key to a strong box containing incriminating documents’ than it is like be[ing] compelled to reveal the combination to [petitioner’s] wall safe).”

The lower court had ruled, though, that compelling disclosure of the password did not violate the defendant’s Fifth Amendment rights because of statements he had made to police during questioning. “It’s 64 characters and why would I give that to you,” Davis told the law enforcement investigators in response to their requesting his password. “We both know what’s on there. It’s only going to hurt me. No fucking way I’m going to give it to you,” Davis said.

Consequently, the prosecutors argued that the legal doctrine known as the “foregone conclusion exception,” legalized the required admission by Davis of his password. The doctrine, however, originally pertained to only compelled production of paper documents, and therefore Fifth Amendment protections against self-incrimination did not apply when the government previously was aware of the existence, the location, and the password-protected content of the information prosecutors wanted from the computer.

The lower-court agreed with the prosecutors’ legal interpretation that the “foregone conclusions” principle meant that the password was required to be divulged, because the exception, pursuant to earlier U.S. Supreme Court precedent, meant that the password was indistinguishable to other physical material goods, and did not reveal the “contents” of Davis’s mind.

In the Florida case, the ruling was similar: “(t)wo passcodes stand in the way of the state accessing the contents of a phone alleged to belong to a minor. The state sought, and the trial court agreed, to compel the minor to provide two passcodes, finding that ‘the act of producing the passcodes is not testimonial because the existence, custody, and authenticity of the passcodes are a foregone conclusion.’ We disagree. The minor is being compelled to ‘disclose the contents of his own mind’ by producing a passcode for a phone and a password for an iTunes account. Further, because the state did not show, with any particularity, knowledge of the evidence within the phone, the trial court could not find that the contents of the phone were already known to the state and thus within the ‘foregone conclusion’ exception. We grant the minor’s petition for writ of certiorari and quash the trial court’s order compelling the disclosure of the two passcodes.”

“The [Pennsylvania] court rightly rejects the government’s effort to create a giant, digital-age loophole undermining our time-tested Fifth Amendment right against self-incrimination,” said the American Civil Liberties Union (ACLU) senior staff attorney Brett Max Kaufman, in a statement following the Pennsylvania Supreme Court’s decision. To which he added, “(t)he government has never been permitted to force a person to assist in their own prosecution, and the courts should not start permitting it to do so now simply because encrypted passwords have replaced the combination lock … We applaud the court’s decision and look forward to more courts to follow in the many pending cases to be decided next.”

Kaufman said the Pennsylvania high court’s ruling delivers an unambiguous meaning to other courts, but leaves the door open as to how other courts may consider the unaddressed matter of whether an encrypted device was biometrically protected.

In its majority ruling, the Pennsylvania Supreme Court stated that, “(a)s part of its analysis, the trial court looked to the ‘foregone conclusion’ exception to the Fifth Amendment privilege against self-incrimination as articulated by the United States Supreme Court in Fisher v. United States, 425 U.S. 391, 409 (1976). The court noted the rationale underlying this doctrine is that an act of production does not involve testimonial communication if the facts conveyed are already known to the government, such that the individual ‘adds little or nothing to the sum total of the government’s information.’ Trial Court Opinion … quoting Fisher … offered that for this exception to apply, the government must establish its knowledge of (1) the existence of the evidence demanded; (2) the possession or control of the evidence by the defendant; and (3) the authenticity of the evidence.”

The high court added that, by “applying the foregone conclusion exception, the trial court found that, in the case at bar, the computer located in appellant’s residence had hard-wired Internet access only; appellant admitted it was TrueCrypt encrypted; that he was the only user, and he was the only one who knew the password; appellant indicated to [investigators] that ‘we both know what is on there,’ and stated that he would ‘die in prison before giving up the password;’ and that the Commonwealth knew with a reasonable degree of certainty that child pornography was on the computer.”

“Based upon these facts,” the state’s highest court lucidly held, “the trial court determined that the information the Commonwealth sought from appellant was a foregone conclusion, in that the facts to be conveyed by appellant’s act of production of his password already were known to the government. As, according to the trial court, [the] appellant’s revealing his password would not provide the Commonwealth with any new evidence, and would simply be an act that permitted the Commonwealth to retrieve what was already known to them, the foregone conclusion exception was satisfied. Thus, on June 30, 2016, the trial court granted the Commonwealth’s motion and directed [the] appellant to supply the Commonwealth with any passwords used to access the computer within 30 days.”

Davis filed an “interlocutory appeal.”

A three-judge panel of the Superior Court, however, affirmed the original Commonwealth v. Davis decision. That decision was then appealed to the Pennsylvania Supreme Court, whose recent ruling enables the colossal uncertainty to be raised judicially about whether Fifth Amendment protections apply to a person’s biometrics in similar cases.

“Like the trial court, the Superior Court found that, to qualify for the Fifth Amendment privilege, a communication must be testimonial,” the supreme court stated, noting that “the Superior Court observed that the question of whether compelling an individual to provide a digital password was testimonial in nature was an issue of first impression for the court. Building upon the trial court’s analysis, the Superior Court explained that the Fifth Amendment right against self-incrimination is not violated when the information communicated to the government by way of a compelled act of production is a foregone conclusion. The court reasoned that the foregone conclusion exception provides that an act of production does not involve testimonial communication where the facts conveyed already are known to the government and set forth the applicable three-prong test,” citing Fisher.

But, the state’s final judicial arbiter stated, by “applying the foregone conclusion exception, the Superior Court, contrary to the trial court, focused on the password itself, and reasoned that the Commonwealth established the computer could not be opened without the password, that the computer belonged to appellant and the password was in his possession, and that this information was ‘self-authenticating’ ― i.e., if the computer was accessible upon entry of the password, the password was authentic.”

“Further,” the Commonwealth’s Supreme Court stated, the lower superior court “noted that multiple jurisdictions have held that the government’s knowledge of the encrypted documents or evidence that it sought to compel did not need to be exact, and determined that, based on the [investigators’] forensic investigation, as well as appellant’s own statements to the [investigators] while in custody, there was a high probability that child pornography existed on his computer. Thus, the superior court concluded that the trial court did not err in holding that the act of providing the password in question was not testimonial in nature and that [the] appellant’s Fifth Amendment right against self-incrimination would not be violated by compelling him to disclose the password.”

The narrow legal question that was put before the Pennsylvania Supreme Court was this: “May [the appellant] be compelled to disclose orally the memorized password to a computer over his invocation of privilege under the Fifth Amendment to the Constitution of the United States, and Article I, [S]ection 9, of the Pennsylvania Constitution?”

The majority of the state’s high court stated in their ruling that, “(o)ur analysis begins with the United States Constitution. The Self-Incrimination Clause of the Fifth Amendment provides ‘[n]o person … shall be compelled in any criminal case to be a witness against himself’ … This privilege not only applies to a defendant in a criminal trial, but ‘in any other proceeding, civil or criminal, formal or informal, where the answers might incriminate [the speaker] in future criminal proceedings,’” citing Minnesota v. Murphy.

The Pennsylvania Supreme Court clarified, however, that, “(t)he United States Supreme Court has not rendered a decision directly addressing whether compelling a person to disclose a computer password is testimonial. In a series of foundational, but somewhat complex, cases, however, the high court has discussed whether the act of production of documents may be testimonial for purposes of the Fifth Amendment.”

The Commonwealth Supreme Court did, however, emphasize that the U.S. Supreme Court, in a particular case before it, had “determined that the Fifth Amendment privilege was applicable where defendants’ … were required to produce incriminating evidence, and that the act of producing even unprivileged evidence could have communicative aspects rendering it testimonial and entitled to Fifth Amendment protection.”

After citing a litany of U.S. Supreme Court and other case law, the Pennsylvania high court ruled that, “(f)rom this foundational law … we can distill certain guiding principles. First, the Supreme Court has made, and continues to make, a distinction between physical production and testimonial production. As made clear by the court, where the government compels a physical act, such production is not testimonial, and the privilege is not recognized.”

Writing for the majority in in the court’s ruling, Justice Debra Todd stated that, “(b)ased upon these cases rendered by the United States Supreme Court regarding the scope of the Fifth Amendment, we conclude that compelling the disclosure of a password to a computer, that is, the act of production, is testimonial. Distilled to its essence, the revealing of a computer password is a verbal communication, not merely a physical act that would be nontestimonial in nature.”

Thus, Todd noted, “(t)here is no physical manifestation of a password, unlike a handwriting sample, blood draw, or a voice exemplar. As a passcode is necessarily memorized, one cannot reveal a passcode without revealing the contents of one’s mind. Indeed, a password to a computer is, by its nature, intentionally personalized and so unique as to accomplish its intended purpose―keeping information contained therein confidential and insulated from discovery.”

So, she stated, “Here, under United States Supreme Court precedent, we find that the Commonwealth is seeking the electronic equivalent to a combination to a wall safe—the passcode to unlock [the] appellant’s computer. The Commonwealth is seeking the password, not as an end, but as a pathway to the files being withheld. As such, the compelled production of the computer’s password demands the recall of the contents of [the] appellant’s mind, and the act of production carries with it the implied factual assertions that will be used to incriminate him. Thus, we hold that compelling [the] appellant to reveal a password to a computer is testimonial in nature,” and protected by the Fifth Amendment.

Electronic Frontier Foundation (EFF) Senior Staff Attorney Andrew Crocker, who had filed an Amicus Curiae brief with the court, said in a statement that, “(t)his ruling is vital because courts must account for how constitutional rights are affected by changes in technology. We store a wealth of deeply personal information on our electronic devices. The government simply should not put individuals in the no-win situation of choosing between disclosing a password—and turning over everything on these devices—or instead defying a court order to do so.”

“Because your passcode is stored in your head and your biometrics are not, prosecutors have long argued that police can compel a suspect into unlocking a device with their biometrics, which they say are not constitutionally protected,” ZDNet noted. But, “the court … did not address biometrics.”

ACLU of Pennsylvania Peter Goldberger, who argued the appellant’s position before the state supreme court, said in a statement that, “(t)he fundamental issue in this case is the right of every person who is investigated by the police to avoid self-incrimination by remaining silent and keeping their personal thoughts private. The state and federal constitutions promise that people accused of crimes have the right to defend their own liberty. They are under no obligation to assist the police or prosecutors in building a case against them by divulging their innermost thoughts. With this ruling, the Supreme Court of Pennsylvania has reaffirmed fundamental privacy rights, against the wishes of government agents who advocated for a radical transformation of our criminal justice system. “

In its concluding statement in the commonwealth supreme court’s majority ruling, Todd noted, however, that, “(w)e appreciate the significant and ever-increasing difficulties faced by law enforcement in light of rapidly changing technology, including encryption, to obtain evidence. However, unlike the documentary requests under the foregone conclusion rationale, or demands for physical evidence such as blood, or handwriting, or voice exemplars, information in one’s mind to ‘unlock the safe’ to potentially incriminating information does not easily fall within this exception. Indeed, we conclude the compulsion of a password to a computer cannot fit within this exception.”

It was in a footnote to this concluding statement that Todd appraised in a cautionary tone the issue of compelling a physical biometric unlocking of a device remains open to further interpretation by another court.

In their joint Amici Curiae brief to the Pennsylvania Supreme Court on behalf of the states of Utah, Arkansas, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Montana, Nebraska, Oklahoma, and Texas Attorneys General stated the appellant “misapprehends the object of the Fifth Amendment, and adopting his reasoning would render States incapable of executing many lawfully obtained warrants.”

These states top law enforcers posited that the “Fifth Amendment privilege against self- incrimination ‘does not shield against compulsory submission to tests that are merely physical or produce evidence that is only physical in nature, such as fingerprints, measurements, voice or handwriting exemplars, or physical characteristics or abilities.’ In this respect, biometrics are akin to a suspect being forced to put on a shirt, or to give a blood sample, a handwriting exemplar, or a voice recording.”

In citing United States v. Hubbell, the states’ brief propounded that, “even though the act may provide incriminating evidence, a criminal suspect may be compelled to put on a shirt, to provide a blood sample or handwriting exemplar, or to make a recording of his voice.’ This further shows the breadth of the lead opinion’s sweep.”

The states further posed that, “(a)s the top law enforcement officials of their respective jurisdictions, amici States Attorneys General have a strong interest in aiding this court’s decision.”

The California case earlier this year complicated matters even further. The court noted that “the government seeks an order that would allow agents executing this warrant to compel ‘any individual, who is found at the subject premises and reasonably believed by law enforcement to be a user of the device, to unlock the device using biometric features’ [but] This request is overbroad,” explaining that “there are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the court finds that the application does not establish sufficient probable cause to compel any person who happens to be at the subject premises at the time of the search to provide a finger, thumb, or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.”

The ruling then added: “Furthermore, the government’s request to search and seize all digital devices at the subject premises is similarly overbroad. The government cannot he permitted to search and seize a mobile phone or other device that is on a non-suspect’s person simply because they are present during an otherwise lawful search.”

But then the court said, “(w)hile the warrant is denied, any resubmission must be limited to those devices reasonably believed by law enforcement to be owned or controlled by the two suspects identified in the affidavit,” again – as have other judicial rulings – left the question of whether only the suspect or suspects’ devices open to compelled biometric unlocking.

Indeed, the court found that, “(e)ven if probable cause exists to seize devices located during a lawful search based on a reasonable belief that they belong to a suspect, probable cause does not permit the government to compel a suspect to waive rights otherwise afforded by the Constitution, including the Fifth Amendment right against self-incrimination. The Fifth Amendment provides that no person ‘shall be compelled in any criminal case to be a witness against himself’ … The proper inquiry is whether an act would require the compulsion of a testimonial communication that is incriminating.”

And it’s “here,” the court cautioned, that “the issue is whether the use of a suspect’s biometric feature to potentially unlock an electronic device is testimonial under the Fifth Amendment,” emphasizing that “the challenge facing the courts is that technology is outpacing the law,” and that “in recognition of this reality, the United States Supreme Court recently instructed courts to adopt rules that ‘take account of more sophisticated systems that are already in use or in development.’”

So, the matter of whether law enforcement, prosecutors — or even the courts — can in the future compel a defendant to provide his or her physical biometric to unlock an electronic device which is not password protected remains up in the air. In all likeliness, just such a case will be before a court somewhere, and probably sooner rather than latter, as law enforcement and prosecutors clearly posited in their amici to the Pennsylvania Supreme Court, whose ruling that a password in someone’s mind is protected by the Fifth Amendment, but that the clearly cloudy question of whether a person’s bodily biometric has not been established by case law.

That undoubtedly did not go unnoticed by the states’ prosecutors – and other, prosecuting attorneys – who now unquestionably appreciate the necessity of having to articulate reasoning for compelling biometrics – as it seems was unambiguously proffered between the lines of the Pennsylvania Supreme Court’s ruling.

But, as Harjani stated in his ruling, “(t)oday, technology has provided citizens with shortcuts to entering passcodes by utilizing biometric features. The question, then, is whether a suspect can be compelled to use his finger, thumb, iris, or other biometric feature to unlock a digital device.”

“Testimony is not restricted to verbal or written communications. Acts that imply assertions of fact can constitute testimonial communication for the purposes of the Fifth Amendment,” he declared.

The U.S. Supreme Court undoubtedly awaits one or another of these cases to be brought before it, and will ultimately have to settle the question.

Article Topics

access management  |  biometric data  |  biometrics  |  data protection  |  encryption  |  law enforcement  |  legal  |  mobile device  |  passwords  |  United States