Face ID, Touch ID unlocks can't be compelled by law enforcement, rules federal judge

The police cannot force a person to unlock their iPhone with Face ID or Touch ID, a U.S. federal judge has ruled, a move that effectively provides users the same protection for the biometric security for their devices as previously afforded to passcodes.

In the United States, a suspect's property has the potential to be searched by law enforcement officials as part of an investigation, but some items are typically left alone. While people are protected from having to unlock their devices via a passcode, biometric security has been considered fair game for use by investigators, bypassing the passcode rules.

A January 10 filing in the United States District Court for the Northern District of California applying for a search warrant for a residence in Oakland reveals investigators wanted to look into the affairs of suspects in an alleged blackmail attempt, where they were claimed to have threatened to "distribute an embarrassing video" of the victim unless a payment was made.

As part of the warrant request, there was also a request to compel individuals present in the search to use a fingerprint reader, facial recognition, or iris recognition to unlock devices found on the property. In the filing, the court denies the request, as it "runs afoul of the Fourth and Fifth Amendments," specifically in relation to unlocking devices.

Judge Kanis Westmore deemed the request was too "overbroad" due to not being limited to any particular computers or devices owned by an individual or multiple persons. More importantly, Westmore declared the government and its agents were not allowed to use biometrics to force an unlock of a device, due to the potential for self-incrimination.

The problem is that, while a user can state a passcode as a "testimonial communication," biometrics do not count in the same way, as they can easily be acquired via unwilling means. For example, it would be feasible for Touch ID to be triggered by forcibly holding a finger to the Home button for reading, or for Face ID to be defeated by the suspect being forced to look in the TrueDepth camera's direction for a moment.

"If a person cannot be compelled to provide a passcode because it is testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, face, or other biometric feature to unlock that same device," wrote Westmore. "The undersigned finds that a biometric feature is analogous to the 20 nonverbal, physiological responses elicited during a polygraph test, which are used to determine guilt or innocence, and are considered testimonial."

While this does effectively block one avenue of evidence collection for the law enforcement agents, it doesn't completely stop the investigation from going down that route. The ruling could be overturned in the future, a second narrower warrant could be requested, or the government could make a request for the data from Facebook itself.

Since the introduction of biometric security to iPhones and other smartphones, there have been reports of law enforcement agencies taking advantage of the technology to gain access to mobile devices, with the courts permitting their use in warrants.

In 2016, a woman was compelled to use her fingerprint to unlock an iPhone confiscated from a property owned by an Armenian Power gang member, one who at the time was in prison for unrelated charges. There have also been multiple instances where members of law enforcement have used fingers of corpses to attempt to access iPhones and obtain evidence, though with little success due to the amount of time that had passed since the last successful unlock.

Such actions are not limited to fingerprints. In August 2018, the FBI ordered the unlocking of an iPhone X using Face ID as part of a child abuse investigation in Columbus, Ohio. A forensic firm has also warned police to avoid looking at the screen of an iPhone X or other Face ID-secured device, or else potentially lose the ability to attempt a face-based unlock in the future.