This week, Apple launched its latest product, the iPhone X. Among its newest features, the iPhone X includes Face ID facial recognition software. According to Apple, “[w]hen Face ID detects and matches your face, iPhone X unlocks without asking for the device passcode.”[1] Face ID is designed to “provide robust authentication with a low false match rate, and mitigate both digital and physical spoofing.”[2] Face ID might provide easy access for users, but it also raises serious questions about constitutional protections to your right to privacy. Almost two years ago, Apple refused to assist the government in retrieving encrypted data from the San Bernardino shooter’s iPhone, citing concern about the effect this kind of “master key” would have for the privacy rights of its users.[3] Despite this concern, however, the biometric features included in its latest phones might have the exact opposite impact on user privacy than Apple intends. While these issues originally arose with the use of fingerprint operated phones, Face ID presents the opportunity to reconsider how biometric data is treated by courts and whether it is the appropriate approach.
The Fourth Amendment protects “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.”[4] Apple’s shift from passcode protected phones to biometric security options––including fingerprint passcodes and Face ID––allows for police to access your phone’s content much more easily, by simply holding up the phone to your face, or ordering you to place your finger on the phone. But can the police lawfully force a suspect to use their Face ID to unlock their phone without violating their Fourth Amendment rights? The answer to this question seems to be a resounding “no”. In 2014, the Supreme Court considered whether the contents of your cell phone are protected under the Fourth Amendment.[5] The Court held that your phone’s contents are inherently private, and “[a]llowing the police to scrutinize [a digital record of nearly every aspect of the owner’s life] on a routine basis is quite different from allowing them to search a personal item or two in the occasional case.”[6] Thus, the police must generally obtain a warrant if they intend to search your cell phone.[7] Despite how easy it may be for an officer to unlock your phone with Face ID, your privacy rights have not been eroded. Without a warrant or consent, the police would not lawfully be able to access your phone.[8]
Despite your right to privacy under the Fourth Amendment, the type of passcode you use can actually determine whether the information contained on your cell phone is protected. This is tied to the Fifth Amendment’s protection against self-incrimination, which provides that “[no person] shall be compelled in any criminal case to be a witness against himself.”[9] The Fifth Amendment, however, only applies to “testimonial” evidence.[10] Thus, the fundamental question is whether your face or fingerprint is considered testimonial.
In determining whether a communication is testimonial, the Supreme Court held that “an accused’s communication must itself, explicitly or implicitly, relate a factual assertion or disclose information . . . [the] privilege may be asserted only to resist compelled explicit or implicit disclosures of incriminating information.”[11] In Doe v. U.S., the Supreme Court held that the defendant was required to sign consent forms which would disclose bank records related to accounts he was suspected of controlling.[12] The court reasoned that the defendant’s signature was more akin to “be[ing] forced to surrender a key to a strongbox containing incriminating documents,” than it is like “be[ing] compelled to reveal the combination to [a] wall safe.”[13] Because the consent form did not explicitly or directly establish whether the alleged accounts existed, requiring the defendant to sign the forms was not self-incrimination.[14]
Courts have repeatedly held that there is no Fifth Amendment protection against the production of blood samples, DNA, voice, or even fingerprint evidence.[15] Such evidence is not considered testimonial because it does not require the declarant to say anything about what is going on in his mind.[16] In fact, the Supreme Court held that requiring a defendant to speak during a lineup was not self-incrimination by distinguishing between the “compulsion of the accused to exhibit his physical characteristics” and the “compulsion to disclose any knowledge he might have.”[17] Under this analysis, it is likely that a court would not find a Fifth Amendment violation in requiring a defendant to unlock his or her phone through Face ID, because using Face ID seems to objectively be “exhibiting physical characteristics,” not disclosing further information.[18]
But is Face ID just the exhibition of physical traits, or is it something more? There is no dispute that your face is a physical characteristic, but in the context of Face ID, it is being used as the passcode itself. That is, your facial structure is transformed from a simple physical trait to a communication that should be protected under the Fifth Amendment.[19] Indeed, it seems illogical to protect a defendant from being compelled to input a numerical passcode, but to compel them to input their biometric passcode. Unless courts begin to draw a distinction between biometric data as a passcode and biometric data as a physical characteristic, as newer technology surfaces, consumers should be aware of the inverse relationship between these enhanced security measures and the legal protection of the contents of their phone.
[1] Face ID Security Guide, 2 (Nov. 2017), available at https://images.apple.com/business/docs/FaceID_Security_Guide.pdf.
[2] Id.
[3]Alina Selyukh, A Year After San Bernardino And Apple-FBI, Where Are We On Encryption?, All Tech Considered (Dec. 3, 2016), http://www.npr.org/sections/alltechconsidered/2016/12/03/504130977/a-year-after-san-bernardino-and-apple-fbi-where-are-we-on-encryption.
[4] U.S. Const. amend. IV.
[5] See Riley v. California, 134 S. Ct. 2473 (2014).
[6] Id. at 2490.
[7] Id. at 2493.
[8] See Janus Kopfstein, Court: Cops Need a Warrant to Open Your Phone, Even Just to Look at the Screen, Motherboard (Apr. 24, 2016), https://motherboard.vice.com/en_us/article/yp3wpj/court-cops-need-a-warrant-to-open-your-phone-even-just-to-look-at-the-screen.
[9] U.S. Const. amend. V.
[10] United States v. Wade, 388 U.S. 218, 222-223 (1967) (explaining that protection against self-incrimination applies when defendant is asked “to disclose any knowledge he might have,” or “to speak his guilt”).
[11] Doe v. United States, 487 U.S. 201, 212 (1988).
[12] Id.
[13] Id. at 211, n.9.
[14] Id. at 215.
[15] See Commonwealth v. Baust, 89 Va. Cir. 267 (2014) (fingerprint); Gilbert v. California, 388 U.S. 263 (1967) (handwriting); Wade, 388 U.S. 218 (voice); Schmerber v. California, 384 U.S. 757 (1966) (blood test).
[16] Doe, 487 U.S. at 216.
[17] Wade, 388 U.S. at 222.
[18] See id.
[19] See Kaveh Waddell, Can Cops Force You to Unlock Your Phone With Your Face?, The Atlantic (Sept. 13, 2017), https://www.theatlantic.com/technology/archive/2017/09/can-cops-force-you-to-unlock-your-phone-with-your-face/539694/; see also Louise Matsakis, We Asked 6 Privacy and Legal Experts About Apple’s New Face ID, Motherboard (Sept. 13, 2017), https://motherboard.vice.com/en_us/article/7xkp7a/iphone-8-iphone-x-face-id-legal-privacy-surveillance.