Last week, a California magistrate judge denied federal prosecutors’ application for a search warrant on the grounds that law enforcement cannot force people to unlock their phones using biometric features, such as fingerprints and facial recognition.

The case pertained to an investigation of extortion in which suspects allegedly sent an online message threatening to post an embarrassing video of a victim if he refused to pay them.  Law enforcement sought a warrant to search for and seize evidence of the crime, including electronic devices, at a property in Oakland, California.  The government also sought the authority to compel any individual present at the time of the search to use biometric features, including fingerprints, facial recognition, or iris recognition, to unlock digital devices found in the search.

The court held that the request violated the Fourth Amendment because it was overbroad, as it was “neither limited to a particular person nor a particular device.”  The court noted that the government “cannot be permitted to search and seize a mobile phone or other device that is on a non-suspect’s person simply because they are present during an otherwise lawful search.”

The court also held that the Fifth Amendment prohibited law enforcement from forcing individuals to engage biometric features to unlock phones and other digital devices found during the search.  The ruling marks a departure from prior decisions considering whether law enforcement can force people to provide biometric passcodes in light of the Fifth Amendment’s guarantee that an individual may not “be compelled in any criminal case to be a witness against himself.”  Other courts previously have held that forcing a person to provide an alphanumeric passcode would compel incriminating testimonial communication in violation of the Fifth Amendment, but that biometric passcode information (such as a fingerprint) was not testimonial and thus did not implicate the Fifth Amendment.  In so ruling, prior courts have relied on established case law holding that compelled biometric testing, such as blood-sampling, fingerprinting, or taking DNA swabs, does not implicate the Fifth Amendment.

In her ruling last week, however, the magistrate judge concluded that a biometric passcode is an incriminating testimonial communication because it operates exactly the same as an alphanumeric passcode, which is protected from compelled disclosure by the Fifth Amendment.  “If a person cannot be compelled to provide a passcode because it is a testimonial communication,” the court reasoned, “a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device.”

The court distinguished biometric passcodes, such as fingerprints used to open a cell phone, from other forms of evidence obtained with biometrics, such as traditional fingerprinting.  The court reasoned that compelling someone to affix her finger to a phone to unlock it is testimonial because it confirms ownership of the device and allows law enforcement to access all of its contents.  The court observed that the act of unlocking a phone with a finger grants access to physical evidence that “far exceeds” the evidence available as a result of fingerprinting.  The court stated that a biometric passcode is “analogous to the nonverbal, physiological responses elicited during a polygraph test, which are used to determine guilt or innocence, and are considered testimonial” and thus protected by the Fifth Amendment.

The court made clear that the Fourth Amendment violation could be cured on a resubmission of a warrant application that is limited to those devices believed to be owned or controlled by the two suspects identified in the affidavit.  On the other hand, the court suggested that access to biometric passcodes would always violate the Fifth Amendment, even if the government “may never be able to access the complete contents of a digital device.”  But the court stated that, in this case, the government could obtain the relevant data through other means, including by seeking access to communications from the provider under the Stored Communications Act.

In rejecting the government’s warrant application, the court relied on recent Supreme Court decisions addressing law enforcement access to information in light of new technologies.  In particular, the magistrate judge relied on the Supreme Court’s recent landmark decision in Carpenter v. United States.  As we’ve previously discussed on Inside Privacy, in holding that police must use a warrant to obtain records that detail the location and movements of a cell phone user from a cell phone company, Carpenter defines how the Fourth Amendment applies to digital information.  Going forward, we can expect courts to continue to grapple with the constitutional implications of new technologies—including the relationship between the Fifth Amendment and law enforcement access to digital information.