Will Apple’s FaceID Affect Your Rights?

You’re stopped by the police and your phone is taken. Can the cops just turn your phone around, point it at your face, and gain access to everything on the device?

That’s the scenario that has many people worrying since Apple announced last week that its new iPhones will allow users to unlock their phones by simply gazing into the front cameras of their devices. That new feature brings the company deeper into a legal debate that it helped kick off years ago with the introduction of a similar feature, TouchID, which uses fingerprints to unlock phones. The introduction of FaceID will likely spur the litigation of difficult questions concerning the Fourth Amendment right against unreasonable searches and seizures and the Fifth Amendment right against self-incrimination.

So what should people know about the legal implications of using this new feature?

Let’s take the easy part first. Under the Supreme Court’s 2014 ruling in Riley v. California, it is crystal clear what police must do in order to search a cellphone obtained during an arrest: In the words of Chief Justice John Roberts, they have to “get a warrant.” (For now, the government argues that the border is excepted from that requirement, but a new lawsuit filed by the ACLU and the Electronic Frontier Foundation seeks to change that.) The warrant requirement holds no matter how the government wants to search the phone, locked or unlocked: by thumbing around itself, by using sophisticated software that can guess your password and review the phone’s full contents, or by using your own fingerprint to unlock the phone. That requirement would also apply if the government wanted to unlock your phone via FaceID.

Moreover, there are limits to what even a warrant can do: In a recent opinion, a federal magistrate judge rejected a request for a warrant that sought to compel any person present at the time of a police search to use their fingerprints to unlock devices present at the scene, ruling that the demand lacked probable cause as to any particular person.

Now to the murkier part. Under the Fifth Amendment, an individual may not be “compelled in any criminal case to be a witness against himself.” This — the right against self-incrimination — is perhaps the most well-known of the guarantees listed in the Bill of Rights, featuring in countless films and episodes of Law & Order. But while the right is easy to dramatize, it is exceedingly difficult to apply, not least because it is a highly formal doctrine without a large amount of Supreme Court guidance.

The focus of Fifth Amendment self-incrimination is testimony. This is why most films or television shows will illustrate it by having a witness on the stand “take the Fifth” before a stunned judge and jury in order to avoid answering any questions that could reveal his own criminality. But the Fifth Amendment also protects against compelled self-incriminating “testimonial acts,” including so-called “acts of production.” At the most basic level, if a non-verbal act would tell the government something incriminating akin to the kind of testimony it could elicit from asking you questions — revealing the contents of your mind — then the introduction of it as evidence at trial it is barred by the Fifth Amendment.

In the classic paradigm, the compelled entry of a safe’s combination is testimonial, and thus protected against by the Fifth Amendment, because it requires the use of the contents of an individual’s mind. But generally speaking, the compelled production of a safe’s key is not testimonial, and is thus unprotected, because it involves a purely physical act.

But even where an act is deemed to be testimonial, it doesn’t necessarily get full Fifth Amendment protection. That’s because of the so-called “foregone conclusion” doctrine, under which the government can get around the self-incrimination right if it knows enough about the facts it will learn through an individual’s testimony. In other words, when the government already knows something, compelling you to produce it is not really “testimony” for self-incrimination purposes. For example, a criminal defendant might try to challenge the introduction of a compelled statement that “the body is buried on Green Bay Road,” arguing that the statement was incriminating and testimonial. But the government might respond that the testimony at issue — the location of the body, and the fact that the defendant knew it — were “foregone conclusions,” since the police already had eyewitness accounts of those facts.

But what this doctrine actually requires is also hotly debated. Some have argued that all law enforcement needs to know is that the individual owns or controls the device in question, justifying the compelled entry of the password. That runs contrary to a recent 11th Circuit case, which held that the government had to show with “reasonable particularity” what evidence would be found on the device. The ACLU and EFF have argued in recent amicus briefs in support of the latter view, in part to prevent government fishing expeditions for evidence, and because the privacy interests at stake support a stiffer legal standard.

When it comes to modern smartphones, courts have so far held that the protections of the Fifth Amendment vary depending on how you set up your device.

In a 2014 case out of a Virginia state court that seems to have set off the current debate, police obtained a search warrant to search a suspect’s home and to seize various items, including his smartphone that had TouchID enabled. The judge in that case drew a bright line: Under the Fifth Amendment, police could not force the suspect to communicate his passcode, but they could force him to use his fingerprint to unlock the device. The reason? Providing a fingerprint was “non-testimonial,” because it did not require the suspect to produce anything from his own mind. On the other hand, to give up your personal passcode is classically testimonial, since it comes from your head. If that dichotomy is correct, and future courts adhere to it, then FaceID presents simply a different version of that — meaning Fifth Amendment protection is lost when you use biometric “keys” to protect digital devices, including fingerprints or faceprints.

But it may not be so simple. First, there are good reasons to believe that the same Fifth Amendment protections should apply no matter how the government seeks to unlock your phone with your assistance. Earlier this year, a magistrate judge questioned whether old cases holding that biometric collections for pure identification purposes should apply to the new fingerprint readers, since they are used for purposes that go far beyond identification:

We do not believe that a simple analogy that equates the limited protection afforded a fingerprint used for identification purposes to forced fingerprinting to unlock an Apple electronic device that potentially contains some of the most intimate details of an individual’s life (and potentially provides direct access to contraband) is supported by Fifth Amendment jurisprudence.

Second, devices that not only lock data, but encrypt it (by transforming the 1s and 0s on a device into an incomprehensible mishmash that can be reversed only by entering the correct decryption key) present a distinct issue. In our recent briefs, the ACLU and EFF argued that forcing an individual to decrypt data on a digital device will always be testimonial, regardless of what the government already knows — akin to the government forcing her to translate into English a diary written in a personal secret language.

As you can see, this area of law is far from definitive. As law enforcement continues to exploit new features like TouchID and FaceID to gain access to devices, courts will have to grapple with these new realities, and how old cases about keys and combos remain relevant in a world where a device smaller than a deck of playing cards can hold a warehouse worth of personal papers.

But here’s the best summary we can offer: If you use a passcode to protect your device, you will sometimes have a Fifth Amendment right that prevents the government from forcing you to unlock (and decrypt) your device, depending on what the government already knows. Of course, your passcode should be strong, and you should enable a guess-limiting feature on your smartphone.

You should also enable Apple’s new feature allowing you to quickly disengage TouchID and FaceID to require a passcode, since if you use a biometric, the current trend suggests you could lose any shot at a Fifth Amendment argument. Though depending on how the law develops, that could change.