Passwords, Biometric Features, and Fifth Amendment Self-Incrimination:
Robert C. Phillips
DDA (Ret)
February, 2019
An interesting debate has surfaced recently concerning a criminal suspect’s Fifth Amendment self-incrimination rights as they relate to passwords and certain “biometric” features, used to prevent third party access to cellphones and other digital or electronic devices. The issue recently came to a head when federal Magistrate Judge Kandis A. Westmore declined to authorize a search warrant and chose to publish an opinion as to her reasons in In re Search of a Residence in Oakland.[1]
Search Warrant Application:
A federal investigation was initiated in a case where it was alleged that two specific individuals used Facebook Messenger to extort money from a victim by threatening to distribute an embarrassing video of him if he did not provide the suspects with monetary compensation. As a part of the ensuing investigation, government agents (the agency not being identified) submitted an application to federal Magistrate Judge Westmore for a search warrant for the suspects’ Oakland residence. Listed in the warrant application as things to be seized and searched were all electronic and digital devices found in the residence. Also included in the warrant application was a request for authority to compel any individual present at the time of the search to provide their passcodes to those devices, or, if necessary, use their finger, thumb, or other biometric feature such as facial or iris recognition, in order to unlock the digital or electronic devices found at the scene, and to gain entry to, and permit a search of the contents of, each respective device.[2]
Although the Magistrate Judge found sufficient Fourth Amendment probable cause to justify a search of the listed premises as well as the two suspects (based upon facts not described in her written decision), she declined the agents’ requests for permission to search anyone else who happened to be present, as well as any and all electronic devices. The Court found these requests to be overbroad in that they were neither limited to a particular person or persons (i.e., the two suspects in the extortion), nor to any particular device, noting the lack of probable cause to compel anyone other than the two listed suspects to do anything, or to include within its provisions the right to search any and all unspecified digital devices that might be found at the premises during the search.[3]
Electronic Device Passcodes:
But more to the point of this article, the Magistrate Judge also noted that the agents’ request for permission to compel persons at the scene to provide passcodes to their respective electronic digital devices, if granted, would violate the subjects’ Fifth Amendment’s self-incrimination protections.[4] As discussed below, Magistrate Judge Westmore was probably right as to this conclusion.
As noted by the Magistrate Judge, individuals have had the ability to lock their personal electronic and digital devices for decades, using numeric or alpha-numeric passcodes to open them. Although yet to have a published decision directly on point from either a U.S. Supreme Court or any California court, lower appellate court case law from other jurisdictions tells us that a person cannot be compelled to provide a passcode to a digital device under the Fifth Amendment (absent an exception) in that the act of providing law enforcement with one’s passcode constitutes a “testimonial communication.”[5]
These cases tell us that a physical act is “testimonial” when the act is a communication that “itself, explicitly or implicitly, relate[s] a factual assertion or disclose[s] information.”[6] Providing law enforcement with a passcode has consistently been held to be testimonial because it reflects “(t)he expression of the contents of an individual’s mind. . . .”[7]
This rule grew out of a long line of cases dealing with various governmental agencies attempting to force criminal suspects to provide access to private—potentially incriminating—documents or records, typically contained in a suspect’s bank accounts or other document repositories.[8]
In sharp contrast to this rule, however, it is recognized that the Fifth Amendment does not prevent a criminal suspect from being required to provide “real or physical” evidence, such as a blood sample[9] or handwriting exemplars,[10] or to stand in a live lineup in front of witnesses, wearing certain items of clothing and repeating phrases spoken by the perpetrator of a crime.[11] None of these forms of evidence fall into the category of a “testimonial communication.”
Biometric Features:
Magistrate Judge Westmore did not stop with passwords, however. As noted above, the agents who applied for the search warrant in this case also asked for authority to compel individuals present at the residence to use certain biometric features, such as pressing a finger or a thumb onto the screen of their digital devices, or using facial or iris recognition, if necessary in order to unlock the digital or electronic devices found at the scene. As so aptly noted by the Magistrate Judge: “Today, technology has provided citizens with shortcuts to entering passcodes by utilizing biometric features. The question, then, is whether a suspect can be compelled to use his finger, thumb, iris, or other biometric feature to unlock a digital device.”[12]
Magistrate Judge Westmore, in declining to issue the warrant, specifically differentiated this request from those cases upholding the requirement that a suspect provide real or physical evidence, while at the same time finding fatal similarities to those cases compelling a suspect to provide his or her password. In so finding, she specifically held “that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device.”[13]
On this issue, the Magistrate Judge—ignoring significant case law to the contrary—is probably wrong.
In finding the forced used of one’s biometric features to be testimonial, and thus implicating the Fifth Amendment, the Magistrate Judge cites a single case in support of her conclusion on this issue which itself is from another federal district (trial level) court, located in Illinois; i.e.: In re Application for a Search Warrant.[14]
The Illinois court did in fact rule that the Fifth Amendment privilege barred the compelled use by the defendant of his fingerprint to unlock a cellphone because that act of pressing his finger to the cellphone’s screen produced the contents of the phone. As reasoned by the Illinois court; “With a touch of a finger, a suspect is (in effect) testifying that he or she has accessed the phone before, at a minimum, to set up the fingerprint password capabilities, and that he or she currently has some level of control over or relatively significant connection to the phone and its contents.”[15]
As authority for this argument, both the Illinois court and the Magistrate Judge in In re Search of a Residence in Oakland cite a federal Eleventh Circuit Court of Appeal decision that held that a witness’s “act of production itself could qualify as testimonial if conceding the existence, possession and control, and authenticity of the documents tended to incriminate them.”[16] The Eleventh Circuit in turn cites the U.S. Supreme Court decision of Fisher v. United States,[17] which refers to this concept as the “implicit authentication” rationale.[18] The only problem with going down this path is that In re Application for a Search Warrant is a password case, dealing with the compelled decryption of a computer hard drive’s contents. Fisher is neither a password nor a biometric feature case, involving the issue of a government-issued subpoena for a criminal defendant’s personal records. Neither case discusses the lawfulness of requiring a person to open his or her digital or electronic devices utilizing biometric features.
Totally ignored by the Magistrate Judge is a comprehensive and relatively recent discussion of this issue by the Minnesota Supreme Court in Minnesota v. Diamond.[19] In noting the issue to be one of first impression, the Minnesota Supreme Court held that a suspect’s act of providing a fingerprint to the police to unlock a cellphone was in fact not a testimonial communication. This is because the compelled act of providing a fingerprint elicited only physical evidence from defendant’s body and did not reveal the contents of his mind. Thus, by not constituting a “testimonial communication,” the compelled use of a biometric feature to open the defendant’s cellphone did not violate the Fifth Amendment privilege against self-incrimination.[20]
Also, the Magistrate Judge in In re Search of a Residence in Oakland ignored the findings of a Virginia state case entitled Commonwealth of Virginia v. Baust,[21] even though she cited the case in her decision. Baust involved a situation where police seized the defendant’s cellphone from his home pursuant to a search warrant but were unable to examine its contents because it was locked and encrypted. The government filed a motion seeking to compel the defendant to either produce his passcode or to provide his fingerprint, either of which could unlock the phone. The court denied the motion as to the passcode, holding that compelled disclosure would be testimonial and thus barred by the Fifth Amendment. However, the court granted the motion as to the fingerprint. In upholding this ruling, the Virginia appellate court noted that the Fifth Amendment does not prohibit compelling a defendant to exhibit, and to permit the government to document, physical characteristics such as by submitting to fingerprinting, standing for a photograph, making a voice recording, or providing a blood sample. The Court found this to be no different than requiring a defendant to use his biometric features to unlock a cellphone. After pointing out that the production of a fingerprint, unlike a passcode, did not require defendant to communicate any knowledge at all and thus is not testimonial, the court concluded that the defendant could be compelled to unlock the phone via his fingerprint consistent with the Fifth Amendment.[22]
California:
California courts, of course, are not required to adopt either theory in that everything cited above is considered to be “persuasive” only, and not controlling in California.[23] In analyzing the above authority, however, it would seem that the Magistrate Judge, in failing to take into consideration any case decision above the level of a federal district court, choose to follow the minority opinion when it comes to the issue of whether it violated the Fifth Amendment to compel a person in possession of an electronic or digital device to use available biometric features to unlock that device.
Potential Exceptions:
If, however, Magistrate Judge Westmore’s opinion is to be adopted, one or more of several available exceptions to the rule might be argued, depending upon the circumstances.
First and foremost, what’s been referred to as the “foregone conclusion” doctrine should be considered. Under this rule, the Fifth Amendment does not protect an act of production (e.g., using one’s biometric feature to open a cell phone) when any potentially testimonial component of that act of production—such as the existence, custody, and authenticity of evidence—is a “foregone conclusion” and “adds little or nothing to the sum total of the Government’s information.”[24] Looking at the other side of this coin while trying to decipher what it means, it has been noted that; “(t)he foregone conclusion doctrine not does not apply when the Government cannot show prior knowledge of the existence or the whereabouts of the documents ultimately produced in response to a subpoena.”[25]
Noting that “(t)oday’s mobile phones are not comparable to other storage equipment, be it physical or digital, and are entitled to greater privacy protection,” Magistrate Judge Westmore held that the foregone conclusion exception did not apply to the instant case.[26] Given the fact that search warrants for the contents of digital and electronic devices are seldom able to predict, other than in general terms, what it is that a law enforcement officer expects to find, the Magistrate Judge was probably correct in holding that this exception does not generally apply to circumstances such as are present here.
Another exception that might apply is when a suspect consensually provides a password or agrees to apply the necessary biometric feature to unlock a digital or electronic device. A “free and voluntary” consent has long since been recognized as a substitute for a search warrant or exigent circumstances.[27] Despite it being one’s Fifth Amendment self-incrimination rights a suspect would be waving, as opposed to a Fourth Amendment search and seizure right, it is not likely a court would require a full-blown Miranda[28] admonishment and wavier in order to secure such a consent. This is because asking for consent to search a container of any sort has never required more than the subject’s non-coerced acquiescence, and does not involve the type of situation Miranda was intended to address; i.e., an in-custody interrogation.[29]
Lastly, it is arguable that anyone who is already subject to a parole or probation waiver of his or her Fourth Amendment search and seizure rights might also be compelled to provide passwords and/or to apply the necessary biometric features to open up his or her digital or electronic devices. This is as of yet an undecided issue that will necessarily hinge on whether a court finds that a Fourth waiver can constitutionally be extended to situations where it is a person’s Fifth Amendment self-incrimination rights that are at issue. It would help in this argument for prosecutors, when appropriate, to request upon conviction that a defendant agree to cooperate as a condition of his or her probation when access to digital or electronic devices is requested by law enforcement, specifically waiving his or her Fifth Amendment testimonial rights as are applicable to the issue here.[30]
Conclusion:
How California courts will evaluate all the above has yet to be decided. But the law provided here will at the very least get a prosecutor’s foot in the door, hopefully leading to a favorable decision.
In the meantime, this entire issue is one ripe for U.S. Supreme Court consideration, from deciding whether passcodes are indeed entitled to Fifth Amendment protection under the theory that they constitute a “testimonial communication,” to how biometric features relate to the problem. Governmental forced access to the vast amounts of private information typically contained in digital and electronic devices being a rapidly developing area of the law, we can probably expect, or at least hope for, some Supreme Court guidance in the not too distant future.
[1] (N.D. Cal. Jan. 10, 2019) __ F.Supp.3rd __ [2019 U.S. Dist. LEXIS 5055; 2019 WL 176937].
[2] Id., at p. __
[3] Id., at p. __
[4] Id., at p. __
[5] See also United States v. Kirschner (Mich. 2010) 823 F. Supp.2nd 665;
In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011 (11th Cir. 2012) 670 F.3d 1335, 1346;
Commonwealth v. Baust (Va. Cir. Ct. 2014) 89 Va. Cir. 267.
[6] Doe v. United States (1988) 487 U.S. 201, 209-210
[7] In re Search of a Residence in Oakland, supra, at p. __; citing the dissenting opinion in Doe v. United States (1988) 487 U.S. 201, 219-220.
[8] E.g., see Doe v. United States, supra, pp. 206-219;
Fisher v. United States (1976) 425 U.S. 391;
State v. Alexander (Minn. 1979) 281 N.W.2d 349;
Boyd v. United States (1886) 116 U.S. 616
[9] In re Search of a Residence in Oakland, supra, at p. __; citing Schmerber v. California (1966) 384 U.S. 757.
[10] Gilbert v. California (1967) 388 U.S. 263.
[11] United States v. Wade (1967) 388 U.S. 218.
[12] In re Search of a Residence in Oakland, supra, at p. __.
[13] Id., at p. __.
[14] (N.D. Ill. 2017) 236 F. Supp. 3rd 1066.
[15] Id., at p. 1073.
[16] In re Grand Jury Subpoena Duces Tecum Dated Mar. 25, 2011 (11th Cir. 2012) 670 F.3rd 1335, 1343
[17] (1976) 425 U.S. 391
[18] Id., at p. 412, fn. 2.
[19] (Jan 17, 2018) 905 N.W.2nd 870
[20] Ibid.
[21] (Va. Cir. Ct. 2014) 89 Va. Cir. 267.
[22] Ibid.
[23] Raven v. Deukmejian (1990) 52 Cal.3rd 336, 352;
People v. Wade (2016) 63 Cal.4th 137, 141.
[24] Fisher v. United States, supra, at p. 411.
[25] In re Search of a Residence in Oakland, supra, at p. __; citing United States v. Hubbell (2000) 530 U.S. 27, at p. 43;
See also United States v. Bright (9th Cir. 2010) 596 F.3rd 683;
United States v. Apple Mac Pro Computer, John Doe, et al. (3rd Cir. 2017) 851 F.3rd 238; and
United States v. Kirschner, supra, at pp. 668-669.
[26] Id., at p. __, and citing Riley v. California (2014) 573 U.S. ___, 134 S. Ct. 2473, 2475, 2489.
[27] See Bumper v. North Carolina (1969) 391 U.S. 543, 548.
[28] Miranda v. Arizona (1966) 384 U.S. 436.
[29] Id., at p 445;
See also Arizona v. Mauro (1987) 487 U.S. 520, 529-530
[30] See In re Q.R. (2017) 7 Cal.App.5th 1231; and
In re George F. (2016) 248 Cal.App.4th 7.34
