The New San Francisco Apple Store Could Double as a Future iCar Showroom
Apple's Tim Cook Surprises Apple fans at the Apple Store in Dubai on Saturday

Touch ID may be Secure, But not against the Government

10. 0 PA NEWS -

1af 55 cover Touch ID

In early May we posted a report titled "With a Simple Warrant, You can be forced to unlock your iPhone with your Fingerprint." In that report we noted that "The U.S. Supreme Court has held that police can search phones with a valid warrant and compel a person in custody to provide physical evidence such as fingerprints without a judge's permission. In a recent case reported by the L.A. Times, authorities obtained a search warrant compelling the girlfriend of an alleged Armenian gang member to press her finger against an iPhone that had been seized. The phone contained Apple's Touch ID for unlocking the phone within a limited time frame without a passcode."


The report further noted that "Susan Brenner, a law professor at the University of Dayton said the act of compelling a person in custody to press her finger against a phone breached the 5th Amendment's protection against self-incrimination. On the flip-side, Albert Gidari, the director of privacy at Stanford Law School's Center for Internet and Society says that "Unlike disclosing passcodes, you are not compelled to speak or say what's 'in your mind' to law enforcement." Authorities simply saying "'Put your finger here' is not testimonial or self-incriminating."


2af 55

On Saturday NBC decided to revisit this story and posted a report on their home page first titled "Why Companies Might Want to Rethink Pushing Touch ID." When you click on the link, the title quickly changes to "When should the Police be Able to Get into your Phone."


The NBC report states that "Apple, Samsung and other phone manufacturers have been pushing fingerprint sensors as a convenient security measure. Legal complications, however, might force them to reconsider their marketing strategy.


Opening the phone with a passcode would have violated Bkhchadzhyan's Fifth Amendment protection against self-incrimination, Richards said. But the use of a fingerprint provides law enforcement some legal cover.


Neil Richards, a privacy law professor at Washington University told NBC "Most people don't draw a distinction between a fingerprint and a password, but the law does. Typing 1-2-3-4 to access a phone counts as testimonial, in that it's information that can be used to authenticate the contents of a device. Touch ID, the fingerprint sensor that became available with the introduction of the iPhone 5S in 2013, does pretty much the same thing, except with biometric data instead of a password".


Yet, laws written before smartphones were invented treat them differently. Law enforcement is allowed to collect physical evidence during the course of an arrest, such as DNA evidence or fingerprints. Valerie Barreiro, director of the University of Southern California's Intellectual Property and Technology Law Clinic, told NBC that the issue is that the FBI didn't really treat Bkhchadzhyan's fingerprint like physical evidence. "It's not the same as DNA, where you're trying to establish whether or not someone is at the scene of the crime. That fingerprint is opening up a window into your entire life."


The Supreme Court agrees. In the 2014 case Riley v. California, it held that law enforcement needs a search warrant to open a phone that agents confiscated during an arrest.


Chief Justice John Roberts in the majority opinion wrote: "Modern cell phones are not just another technological convenience. The sum of an individual's private life can be reconstructed through a thousand photographs labeled with dates, locations, and descriptions." Roberts added that "the same cannot be said of a photograph or two of loved ones tucked into a wallet." Roberts also noted that  "The invention of the cloud only increases the amount of information about a person that can be learned from having access to their smartphone."


Barreiro further told NBC that "There is no easy answer to these questions. It will probably take something similar to Bkhchadzhyan's case getting appealed and then heading to the Supreme Court to get any kind of clear answer on what law enforcement can and can't do with a confiscated phone.


Until then, tech companies might want to rethink how they push features like Touch ID. When a court ordered Apple to unlock the iPhone used by the San Bernardino shooter, the company didn't mince words, calling it a 'dangerous precedent' that would 'hack our own users and undermine decades of security advancements.'


In the end, Neil Richards, a privacy law professor at Washington University told NBC that "They're going to start thinking twice about nudging people toward just using fingerprints. It is secure against private parties, but under current law, it's not as secure against the government." For more on this read the full NBC report here.


10. 1 PA - Bar - NewsAbout Making Comments on our Site: Patently Apple reserves the right to post, dismiss or edit any comments.




The comments to this entry are closed.