44 ms·

Judge Grants Search Warrant Forcing Woman to Unlock iPhone with Touch ID

218 points by outworlder 11y ago

JoshTriplett 11y ago
You can be compelled to provide fingerprints based on a warrant; I'm unsurprised (and not particularly bothered) that you can be compelled to use them on your own device. If you care about security, don't use a fingerprint alone; at most, only use it as a second factor for two-factor authentication. More generally, don't use anything that removes your ability to make a choice under duress, in whichever direction you see fit, based on what you're protecting and what you're being threatened with. I find the ongoing case of someone being jailed indefinitely for refusing to supply a passphrase far more concerning than someone being compelled to supply a fingerprint.
- JadeNB 11y ago
  You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be. I think that it is possible to be an intelligent but non-technical person and (EDIT: forgot the word 'not') realise that, all technical issues aside, the "something you know" and "something you have" parts of a password are on completely different legal footing; and I think that it is reasonable even for a technical person to wonder whether it should be so. EDIT: I know that complaints about downvotes are not welcome, and it's quite possible that I'm wrong in what I say, but I'd like to be told how rather than just downvoted! My comment was meant to be a constructive contribution. EDIT 2: Wow, these many replies help a lot! Thanks!
  - JoshTriplett 11y ago
    I agree with the comments below: a fingerprint is a username, not a password. I don't have a problem with compelling the provision of identification given an appropriate warrant; I do have a problem with compelling the provision of information held only in someone's head, with or without a warrant.
    - EdHominem 11y ago
      But it's not being used as a username, it's being used as a password. (Or rather, a username and a password.) It's hacking to bypass even a trivial password, so similarly it should be unreasonable to compel disclosure of even a trivial password... They don't need your usename - your phone assumes it's you and only asks for the password... The fingerprint that they're seeking is not a username, it's a crappy password.
  - dragonwriter 11y ago
    "Something you have" isn't part of a password, its an alternative, non-password factor; passwords are always "something you know". There is a trend to use biometrics in place of passwords, which is a convenience feature which compromises security, even though it is often misrepresented as a security feature. (Using biometrics as a second factor helps security, but there is a big difference between "and" and "or" security measures.)
    - m_eiman 11y ago
      A fingerprint can improve security in at least one way: it makes it impossible to shoulder-surf your password since you're not entering it.
  - pc86 11y ago
    Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written.
    - JadeNB 11y ago
      > Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written. I agree, but then neither are we the courts; and it is precisely the role of the commons to discuss the law as it should be, so that the legislative branch can, hopefully, enshrine that communal wisdom in the law as it is.
      - pc86 11y ago
        You are right, I misinterpreted your comment.
  - gruyere 11y ago
    per your edit, you seem to forget you're at HN.
  - eganist 11y ago
    > but I'd like to be told how rather than just downvoted! It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device.
    - JadeNB 11y ago
      Thank you for your response! > It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. Rather than endorsing or decrying the law, I meant only to suggest that a simple, factual description of the state of the law, while non-controversial, also doesn't address the question of whether the law is appropriate. I am not at all sure that it is; but I am also a naïf in these matters, which is why I appreciate the many users who responded to my request for clarification. > I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device. Indeed, I think that the point you make (and generously attribute to me) is a good one orthogonal to any questions of the law; whether the law is good or bad in any particular sense, it is as it is, and will be so enforced, and users should be educated as far as possible about this when choosing whether and how to secure their devices.
  - DannyBee 11y ago
    "You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be." Fingerprints and other things like them are 100% non-testimonial. The fifth amendment does not cover non-testimonial evidence (because it only covers being a witness against yourself). This has been law since the amendment was enacted, was the purpose of it, etc. So I suspect if you want the law to be something else, your problem isn't even with the courts or judges, it's with the founders :)
    - spdustin 11y ago
      Not true. There is an adage that the government can force you to produce the key to a lock, but not the combination to a safe. It just so happens that, today, the government can compel you to perform a physical gesture that, by proxy, happens to be used as a key on a device that normally accepts a combination. If it's been 48 hours since your finger was last applied to the Touch ID sensor on an iPhone, that "key" doesn't work any more. So, until the fingerprint is accepted by the courts as a "combination" (effectively, that's how the "common man" sees it, and which the courts treat as testimony-by-proxy) rather than a physical gesture (not testimony at all, and currently easily compelled), the only defense one has (if using Touch ID) is to stall for 48 hours.
      - DannyBee 11y ago
        Your adage is based on random supreme court dicta in Hubbell and Doe, and you know courts have gone either way. ;) So let's just both agree we are suggesting the world is a little more black and white than it is. I would not try to predict what would happen square-on today, given the splits involved.
  - maxerickson 11y ago
    The OP states their opinion a couple of times, so surely that doesn't address the issue of the law as it should be. isn't a very good reply to what they said. That was my reasoning.
    - JadeNB 11y ago
      Thank you for the explanation. Aside from saying once that he was not bothered by this state of things, I took the poster to be mainly explaining the consequences of the law (don't act as if your fingerprint is as secure as your password) rather than specifically endorsing it.
      - JoshTriplett 11y ago
        I definitely wasn't just giving the current state of the law; I was offering the opinion that out of the pile of problems we do have with government overreach, surveillance, and lack of understanding of technology, this case seems perfectly reasonable and not worth worrying about. I'm not bothered by the compelled production of a fingerprint, given the due process of a warrant; I don't see any obvious reason why someone should expect otherwise from the law, nor any right or reasonable expectation this violates, and I don't think the law needs to change in that area. (I do see other issues associated with fingerprints, such as the retention of fingerprints from non-criminals cleared of all charges, but I don't see an issue that applies to this case.) I am bothered by (attempted) compelled production of a passphrase. And I see those as significantly different cases.
- djsumdog 11y ago
  The person who is being held indefinitely for not giving up his password is really frightening. They should either let him go or charge him with contempt of course/obstruction and issue time served! Even if you /know/ you don't have anything illegal on any of my encrypted devices, it's better to take a contempt of court charge than give up a password...because of what they might /find/ or possible things unrelated to an investigation that they can link to a crime (or what they can then plant).
  - JoshTriplett 11y ago
    Contempt is a terrifying charge, because under current law, you can be jailed indefinitely for the same contempt charge for as long as you refuse to cooperate with whatever the court thinks you should cooperate with. There's no upper bound there. So that wouldn't solve the problem.
    - bitJericho 11y ago
      I don't think its a problem for someone actively breaking the law to be held indefinitely for contempt until they stop breaking the law. I thought being compelled to reveal a passphrase was no longer required.
      - themartorana 11y ago
        That's a problem for me. Charge and prosecute them or let them go. Indefinite detention without a fair and speedy trial is unquestionably unconstitutional.
        bitJericho 11y ago
        Well imagine a criminal is holding a piece of your property or even a person and not revealing where that is. Do you think it's reasonable to hold them for 30 days and then let them go and say "ah well I guess you can return that/them if you want cuz you did your time." A charge of contempt is still a charge.
- maaku 11y ago
  > You can be compelled to provide fingerprints based on a warrant; I'm unsurprised (and not particularly bothered) that you can be compelled to use them on your own device. 5th amendment.
  - eganist 11y ago
    Doesn't apply, and this isn't the first opinion to come to that conclusion either. http://pilotonline.com/news/local/crime/police-can-require-cellphone-fingerprint-not-pass-code/article_25373eb2-d719-5a6e-b677-656699a50168.html http://pilotonline.com/news/local/crime/police-can-require-c... 5th amendment appears to be restricted to what you know based on all available rulings thus far. A password would fall under "what you know."
- curt15 11y ago
  In the era of fast 3d printers, what stands in the way of just fashioning a suitable fake finger from the fingerprint?
  - msbarnett 11y ago
    Nothing. The 3d printer is overkill. A fingerprint and a pack of gelatin is more than sufficient.
    - r00fus 11y ago
      Have you personally done or seen this done this then? Quality of the print production seems pretty important...
      - hengheng 11y ago
        Laser printers are perfectly fine. CCC demoed this a few years back: https://youtu.be/aGjGzqYgz0c https://youtu.be/aGjGzqYgz0c
      - berdario 11y ago
        https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in...
      - stcredzero 11y ago
        Mythbusters did it.
        r00fus 11y ago
        Not on an iPhone.
  - mikestew 11y ago
    You might have noticed that ABS plastic doesn't have a lot of similarities with human flesh. That's not to say that it can't be faked, just maybe not with a 3D printer: http://arstechnica.com/security/2014/09/fake-fingerprint-fools-iphone-6-touch-id-why-its-not-so-serious/ http://arstechnica.com/security/2014/09/fake-fingerprint-foo...
- ianopolous 11y ago
  This is why we need plausibly deniable dual login on all accounts, ala truecrypt.
  - MichaelGG 11y ago
    The issue there is that if you aren't really being plausibly deniable (using the fake login), then the court will realise this. For instance, if they know you were using that laptop 1 day ago, but the timestamps on the instance you unlock are all from 2 months ago, they may deduce you are pulling this stunt.
    - paulddraper 11y ago
      And spoliation is illegal.
- stcredzero 11y ago
  You can be compelled to provide fingerprints based on a warrant; I'm unsurprised (and not particularly bothered) that you can be compelled to use them on your own device. I thought that fingerprints were to be provided to: 1) establish biometric proof of identity 2) establish the presence of a person in a particular place 3) establish a person handled a particular object Or does the law establish that the authorities can use fingerprints for evidence in any fashion? Could they use a scan of a fingerprint to etch a fake-fingerprint latex sheet to open your locked device?
  - swyman 11y ago
    Where does that list come from?
    - stcredzero 11y ago
      I am not a police investigator or lawyer, but those are what I understand as a layman to be the uses of fingerprints in practice.
      - swyman 11y ago
        Sorry, I guess I just read your phrasing to have more authoritative intent than you were going for. As I (also not a lawyer) understand it, there's nothing in particular that limits how intermediate/circumstantial pieces of evidence can be used/combined to find more evidence as long as each piece of evidence in the chain was acquired legally.
  - niij 11y ago
    I'm not sure where you're getting this list from. But, I think that #3 would be relevant in this case, as the person would have needed to handle the device to register their fingerprint.
- spdustin 11y ago
  Providing a fingerprint (identification) is different from imprinting your finger to unlock a device. It's been upheld in the past that passwords/passphrases used to unlock encrypted content are considered to be testimony (because it leads to the acquisition and collection of possibly protected "testimony"), and thus protected by the fifth amendment. In my opinion, there is no reason to see imprinting your finger on a sensor used to unlock your phone as anything other than an equivalent form of "testimony", and it should enjoy fifth amendment protection. I don't think it will be long before this exact definition finds its way to the U.S. Supreme Court.
  - drags 11y ago
    My understanding is that the "testimony" would be in the text of the password: compelling someone to reveal the password could be self-incriminating if _the password itself_ led them to additional evidence (e.g. a password of "I hid the revolver in the Conservatory"). [1] I can't think of a case involving a fingerprint where there's a similar risk since the fingerprint is arbitrary data. [1] https://en.wikipedia.org/wiki/United_States_v._Hubbell#Summary_of_the_Act_of_Production_Doctrine https://en.wikipedia.org/wiki/United_States_v._Hubbell#Summa...
    - spdustin 11y ago
      The case law thus far has stated that compelling the decryption of a data storage device really hinges on this: What evidence is known by the prosecution to exist? In several cases, when the defendant makes known that incriminating evidence exists, or when the prosecution is independently aware of the existence of incriminating evidence (they saw the screen before you locked it, and testified that what they saw was evidence of a crime), the defendant was rightfully forced to decrypt the storage device. However, when the prosecution has no specific knowledge that the evidence they seek exists, US courts have ruled that the defendant cannot be compelled to decrypt the storage device, since doing so would be forcing the defendant to reveal that incriminating evidence actually exists. Applying your fingerprint to an iPhone is an act that, without argument, decrypts data on an encrypted storage media, as the act of applying your finger to the sensor instructs the device to retrieve the actual cryptographic information necessary (your passcode/passphrase, plus other hardware-specific data) to access the cleartext of the data. The more and more I think about this, the more confidant I am that a fingerprint, while "something you have", forces you to disclose, by proxy, "something you know" to your phone. I guess the question then is twofold: If you have a combination safe that may contain incriminatory evidence, and a safety deposit box that contains only the combination to your safe, can the courts compel you to give them the key to the safety deposit box? And if so, should they be able to?
- samstave 11y ago
  Fuck you. (The state, not you user: JoshTriplett) But I do NOT agree with your comment. Fuck the state. A state who is trying to use terror and fear and war and crime as an excuse for power is a fucked state - and I want no part of it. The fact is that it is a lame excuse for "security" to use ginger-prints as a "secure" access method to a device such as a phone and then for the state to force people to take finger prints as a sure-identity method, which, ostensibly, could then provide access to all their data and phones, etc. Tell me how that is fucking secure???? So the real argument is about privacy. DO I HAVE ANY OR NOT????
deleted 11y ago
[deleted]
AdmiralAsshat 11y ago
Always remember: your fingerprint is identification. You can be forced to identify yourself to law enforcement. Do not make it your password. Your password is something you know, not something you are.
- djsumdog 11y ago
  Something you know, and ... something you can forget.
- cloudjacker 11y ago
  Or just restart your iPhone.
  - astrodust 11y ago
    I've heard more than one person say if you're going to have to surrender your phone, if there's even the risk of it, turn it off.
    - TazeTSchnitzel 11y ago
      If you turn off your iPhone, you can't use it again without entering your password, and you would have to do that consciously. On the other hand, your phone could otherwise be unlocked with just your fingerprint.
      - colejohnson66 11y ago
        Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? Or does it act like there's just a password?
        thesimon 11y ago
        >Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? I don't know the verbatim message, but it says something along the lines of "Passcode is required to enable Touch ID"
Aelinsaar 11y ago
This... makes sense. You can be compelled to produce your fingerprints, or a physical key, or really anything physical with a warrant. It's the issue of producing KNOWLEDGE from your mind alone that is really the issue most of us care about, or at least, it's a newer issue.
TazeTSchnitzel 11y ago
Touch ID is disabled when an iPhone initially powers on. So, if you want to prevent law enforcement compelling you to decrypt using your fingerprint, hold down the power button and then slide right to power off the phone. Now they need your password.
- M4v3R 11y ago
  PIN Code is also required when you fail to authenticate with Touch ID five times. So one could use the wrong finger a few times and that would solve the problem ;).
  - TazeTSchnitzel 11y ago
    I've noticed that Touch ID is super brittle (at least on my own iPhone 5S), too. If your finger's slightly wet, that may be enough. Indeed, trying it now, if I lick my finger and then use it to try and unlock my iPhone a few times, it disables Touch ID and requires a passcode!
- Lxr 11y ago
  Unless you are prepared in advance, after they take your phone you likely won't have the chance to turn it off.
  - r00fus 11y ago
    I shut off my device before every security checkpoint (i.e., airports) or whenever I get pulled over. Only takes a 5 seconds - inconvenience is worth it.
  - gherkin0 11y ago
    There should also be a timer that puts the phones into require-password mode. So after a few hours they'll need more than a fingerprint. Maybe you should also have the option of setting up a "coercion fingerprint(s)", which if used to authenticate would put the phone into require-passcode mode. Then, if the court compels you to unlock your phone with your fingerprint, you can put yourself back into 5th amendment territory. Actually, in that last case, you might already be protected. If 9 if your fingers will force your phone to require a passcode, and only one will unlock it. Could the courts/police force you to disclose which finger is the one that unlocks? I'd imagine you could put them in a situation where they have to chose which finger you use (or manipulate your hand themselves) to perform the unlock action, and in that case they'd only have a 1/10 chance of actually getting what they want.
FussyZeus 11y ago
Hold the phone (heh): Touch ID is disabled after 24 hours, how in the world did they get a warrant to do this within that time frame? It says in the article that the phone was seized on Feb. 25.
- deleted 11y ago
  [deleted]
- talmand 11y ago
  I've always understood that getting a local judge to expedite a warrant for timely reasons is not unheard of.
- bobwaycott 11y ago
  I believe TouchID is disabled after 48 hours.
- djrogers 11y ago
  The warrant was issued when she was arrested - it would not be at all unusual for police to get warrants for things discovered during an arrest, nor would it be unusual for them to be prepared to request one.
rdudek 11y ago
Would they cut her finger off if she denied that request?
- eganist 11y ago
  No, they'd just hold her in contempt.
  - randyrand 11y ago
    But after 48 hours she no longer has the means to unlock it with her fingerprint.
- goda90 11y ago
  More likely she'd be held in contempt of court, or charged with withholding evidence.
- imtringued 11y ago
  Which finger? You only have 5 tries until the device asks for a password.
dogecoinbase 11y ago
Needs to support a duress finger.
- goda90 11y ago
  Wouldn't using the duress finger result in some sort of destruction of evidence charge?
  - dogecoinbase 11y ago
    As with most duress mechanisms, one would have to judge whether using it was better or worse than not -- I suppose ideally one would have two, one of which simply reenabled the passcode and would have some deniability (this is effectively already possible by using a nonstandard finger, unless LE has witnessed previous successful unlocks and can identify the finger which should be used), and one which initiated a wipe of the phone.
DannyBee 11y ago
I'm not sure why this is surprising, under current precedent,you can be forced to type in your password (https://articles.forensicfocus.com/2012/02/09/another-judge-rules-encryption-passphrase-not-testimonial-under-fifth-amendment-analysis/ https://articles.forensicfocus.com/2012/02/09/another-judge-... covers some cases, but there are a lot of cases). Touch ID is not really different. In general, one of the only reasons you won't be forced to type in your password is if the act of proving you have the password is somehow incriminating (IE there is a dispute over ownership, etc).
saboot 11y ago
Curious, what would happen if you purposefully damage your fingerprint? Say by forcing a burn on your finger using a stove top or car cigarette lighter.
- cheepin 11y ago
  That's a pretty painful option compared to just handling rough objects. I've rendered touchID almost entirely ineffective just by grip taping a skateboard. The answer to your question though is that, at least on the phone's side, it would require your passcode to login
- bdcravens 11y ago
  Mine stops working all the time, especially my right thumb.
- Phlarp 11y ago
  Well, that would hurt, and you would have to permanently damage the entire fingerprint-- as only a small section of the scanned print is really needed to make a match. IANAL: but I would imagine a sour faced judge could call it contempt or maybe destruction of evidence depending on the circumstances?
xoa 11y ago
While it would not be cost-free against law enforcement (as they could charge with contempt/destruction of evidence and so on) I hope as this sort of thing happens more often it pushes Apple to respond with a native coercion code system rather then requiring a jailbreak. Security has been improving at a nice clip in the last 5 years after significant stagnation, and bringing coercion codes to the general public seems like the next straight forward, logical improvement. Apple seems to already have the basic system level infrastructure in place since they store and register each of the five fingerprints separately and fire off appropriate different system events, which is why a jailbroken device can have an imperfect but reasonably effective one. Apple though could make it more user friendly, and have it be not just for Touch ID but also using a PIN. While law enforcement gets the most press, this is and growing threat from non-state actors as well as mobile devices become ever larger gateways to the public's private lives and finances. Apple would do everyone a service by blazing the trail here and sooner (iOS 10) rather then later.
maaku 11y ago
5th amendment: "No person shall be compelled in any criminal case to be a witness against himself." How does this not apply here?
- icebraining 11y ago
  Providing your fingerprint (or blood, or DNA) is not considered testimony.
  - talles 11y ago
    But is kinda silly how "numeric passcodes are protected individual privacies, but fingerprints are not" in this case. The use of your blood or DNA in the case should dictate if it's applicable or not, not the nature of the evidence itself.
    - bendykstra 11y ago
      The purpose of the right against self-incrimination is to prevent forced confessions and torture. With that in mind, it makes sense to draw a line between compelling someone to provide their fingerprint or DNA and forcing someone to divulge something they know. When the state has the right to make someone talk, how does it go about it? Also, it's impossible to know whether someone actually knows the passcode to a device, so someone could end up imprisoned indefinitely just for forgetting a password.
  - Lawtonfogle 11y ago
    Once they can read minds, what then? And this isn't just science fiction; I've read reports that a persons inner monologue is soon to be accessible because when you talk in your head, it causes ever so slight commands to be sent to the voice box, which in turn reacts slightly. Not enough to produce sound or even be noticeable to a person, but which technology is being developed to pick up on.
- superuser2 11y ago
  The same way a search warrant can force you to hand over your diary.
united893 11y ago
If you have five minutes, please see this short video from CGPGrey, which summarizes succinctly why access to your phone is akin to access to brain: > https://www.youtube.com/watch?v=VPBH1eW28mo https://www.youtube.com/watch?v=VPBH1eW28mo
- harryh 11y ago
  I don't think it makes that point well at all. It says that (kinda) but doesn't support the idea with any form of reasoning. In fact, it's a relatively minor point and not really the main point of the video at all. If you had access to my phone you could learn a great many things about me (most of them banal) but there are many many many thoughts in my head that don't exist on my phone in any form. Continued nerd insistence of your point is little more than fetishization of technology. There's a reason Obama used that word at sxsw. It connotes a level of obsession and overfocus that is, quite frankly, pretty creepy.
rdez6173 11y ago
Could it be argued that the knowledge of which finger (or part of your finger) you use for authentication is equivalent to a passcode?
- drostie 11y ago
  Maybe, but you get five tries before you get locked out, so even if your lawyer pleaded successfully with that, the judge could reasonably order that you try with, say, all the fingers of your right hand, or maybe both thumbs and index fingers, without forcing you to disclose that knowledge.
- ihsw 11y ago
  Conversely, is there anything preventing them from having you try all ten fingers?
  - mynameisvlad 11y ago
    Yes, you are locked out after 5 incorrect prints. At that point, you need to use your passcode to unlock your phone. That said, even if they guess that you're most likely to use your thumb, there is still a chance you can't unlock the device, especially on pre-6S devices, since the sensor is a lot more finnicky.
  - deleted 11y ago
    [deleted]
  - simcop2387 11y ago
    Chance. It'll stop accepting them after 5 attempts according to other posters in this thread. Combine that with the fact you don't know if it read properly or not you really don't have good odds that you'll succeed.
    - mywittyname 11y ago
      Plus, I think you can use your knuckles too.
tn13 11y ago
Isn't this same as forcing a person to give testimony against herself ?
- JoeAltmaier 11y ago
  Its more like "what have you got in your pocket?"
- bdcravens 11y ago
  No more than if you were ordered to open the door or a safe for a search warrant.
tn13 11y ago
At this stage the lady may consider temporarily injuring her finger to the extent the iphone does not accept it and falls back to passphrase.
- paulddraper 11y ago
  Self mutilation might not be the best option. I think you'd be a sub par legal advisor.
diegorbaquero 11y ago
Power cycle it. Win.
- bdcravens 11y ago
  Then you get charged with tampering, even if found not guilty on other charges. Probably lesser charge, but not a "win".
kefka 11y ago
"Judge, Which finger am I required to try?" Edit: the question is a legal trap to kept from being held in contempt. After 2 or 3 scans, the device demands a password. By asking which finger, they have a 20% chance of getting right finger.
- Matt3o12_ 11y ago
  No, they have 5 tries, and most people use at least 2 fingers (I use 3) so you can unlock it with both hands. Furthermore, most people use at least their thumb. So if the judge said use your left and right thumb, the chance of succeeding would be a lot higher (statistically speaking). If you use, let's say, your pinky finger, the chance of a judge guessing the right fingerprint is even lower because he will try out the most obvious choices before that.
anigbrowl 11y ago
This doesn't seem that remarkable. It's one thing if you have the combination to a safe and won't give it up; the police will have to get into the safe some other way. On the other hand, if it locks with a physical key which you happen to keep on your belt, I doubt any court would think twice before ordering you to hand it over.
nkrisc 11y ago
I think what's interesting is they're forcing her to verify that it is in fact her phone or that she had access to it. Now, in the case of a phone it likely wouldn't be hard to prove that other ways, but what if it was an otherwise unidentifiable device? It would force her to effectively testify she owned it when the police might otherwise not be able to prove that.
drcube 11y ago
Don't the cops already have her fingerprints? This is partly why biometric authentication is useless. You're supposed to change passwords frequently. How do you change your fingerprints? Who chooses a password the cops already know, and anyone else who knows you has access to?
csense 11y ago
I think the idea of using fingerprints, retina scans, face recognition, etc. as an access token is a fascinating instance of how culture influences technology. These things are very poor candidates for access control because you need fuzzy statistical/ML/AI/CV recognition techniques (which means you have to worry about false positives and false negatives), and it's basically impossible to re-issue credentials in case of a compromise (changing someone's fingerprints or facial characteristics would require performing plastic surgery on the user!) But because of movies and TV, everyone "knows" that in the future we're supposed to have our technology unlocked by our fingerprints, so that's what drives people to buy and vendors to implement, regardless of how absurdly impractical it is if you actually stop to think about it for five seconds.
- CardenB 11y ago
  I think it's more about convenience than sci fi.
- awqrre 11y ago
  In cases where your username is not public, biometrics should not even be used as a "login name"... let alone password.
- shawnz 11y ago
  > But because of movies and TV, everyone "knows" that in the future we're supposed to have our technology unlocked by our fingerprints, so that's what drives people to buy and vendors to implement I, for one, would love fingerprint unlock on my phone. And it's not for any crazy sci-fi expectation -- I just don't see any other method of unlocking my phone which could be as quick and convenient as that. Facial unlock is another possibility, but what concerns me about that is how easily someone could produce a picture of my face.
bdcravens 11y ago
Mine won't accept my right thumb after a day or so. (other fingers seem to be ok though) Probably due to diabetes and the way my medical condition causes clubbing of the fingers (I just re-add that thumb over and over) If she ate a bunch of salt and swelled up a bit, it might have the same affect. Providing the finger scan isn't the same as promising it unlocks.
pessimizer 11y ago
A judge can have you force fed, put into a straitjacket and spitguard, or have people put their fingers up your asshole and vagina. The idea that they can't get you to touch a piece of plastic is absurd. I'd be surprised if they wouldn't sedate you in order to do it. As someone who has been anally probed by the state, I find it pleasantly surprising that they even think they need a warrant to force you to put your finger wherever they want. Do passwords really need to be simplified? Do we invariably have to envision the future as a place where we wave our arms around beams of light and gently touch secret symbols to make things work? Isn't that just a juvenile fantasy of being a magician? Was Excalibur the first touch ID?
spdustin 11y ago
For me, the ongoing question that needs to be addressed by the court is this: Is the content of your smartphone considered to be documentary evidence (something you have) or testimony (something you know). I know I'm mixing definitions of the something you have/know combination, but it's a difference without a distinction, IMHO. I tell my phone, either directly or indirectly, all sorts of things that I would not otherwise document. Locations I've visited, for example. That's something that, unless I've been surveilled, only I know. By unlocking the phone, have I allowed access to documentary evidence, or have I allowed access to an extension of my mind? Is a smartphone a privileged companion? Like an attorney, or a doctor, or a partner? The spousal communications privilege in the US protects the personal conversations I have with my wife from being disclosed via compelled testimony. If she tells me that she committed a crime, or vice-versa, the recipient of that communication cannot be compelled to testify against the utterer. Further, spousal testimonial privilege means that she could not be compelled to describe her observations if they may incriminate me. We have similar affordances in the US for communications with legal counsel, or with medical personnel. I'm going to go one step further and say that 95% of you, dear readers, tell or otherwise provide secrets to your phone that, if you somehow had to communicate to an actual person, you'd only be willing to tell your spouse, your doctor or your lawyer. To me, that makes my smartphone a privileged confidant. And because it routinely collects information that I do not directly provide it, even though I'm capable of observing and remembering it myself, it acts like (and I treat it like) an extension of my mind. An augmentation that increases the capacity of my own brain's memory. I'm not in the habit of committing crimes, though I (like most of you) have committed some infractions in the past (speeding, "TP-ing" a house, a bounced check - ahh, the indiscretions of youth). But the knowledge in my head and the communications I have with privileged recipients may, if taken out of context, be used as documentary evidence supporting any number of charges against me. For example, the fact that I went to Home Depot four times in one week over a year ago could support the charge that I had assembled some device that was later used in a violent crime. That's a scary place to be, isn't it? To know that you did nothing wrong, and yet the vague memories you have of visiting Home Depot last year have potentially been documented more thoroughly by your phone. Is the common man supposed to assume that a smartphone they bought just so their kids can FaceTime with their grandmother 1,500 miles away is silently surveilling them, and can be forced to disclose all manner of information about them? It's a new world, and the laws of the land are old. Legislation moves at a snails pace already, but compared to the rapidity of technological advancement, the law moves like the pitch drop experiment.
banach 11y ago
I guess this will just make (savvy) criminals turn Touch ID off on their iDevices.
ultim8k 11y ago
Judges just go fuck yourself.
DarkContinent 11y ago
The Constitutional right to not incriminate oneself was originally intended to prevent the government from engaging in Star Chamber-style interrogations, i. e. using physical force to extract information from a person. This case frankly doesn't seem any different from such forcible extraction.
randyrand 11y ago
Workaround for the common person: When compelled, try your other fingers first than the one you registered. Do not register your thumb. After 5 tries, your password is required.
cmurf 11y ago
Rubberhose fs, with a modification: two passcodes, one unlocks primary fs A. The other unlocks secondary fs B and causes the DEK for fs A to be wiped.
digler999 11y ago
>a criminal is holding a piece of your property thats what a fucking search warrant is for. are you dense ?
- dang 11y ago
  Personal attacks aren't allowed on HN. We ban accounts that do this; please don't do it again. We detached this comment from https://news.ycombinator.com/item?id=11613437 https://news.ycombinator.com/item?id=11613437 and marked it off-topic.
  - digler999 11y ago
    duly noted. Sorry, I got too excited.

218 points by outworlder 11y ago

You can be compelled to provide fingerprints based on a warrant; I'm unsurprised (and not particularly bothered) that you can be compelled to use them on your own device. If you care about security, don't use a fingerprint alone; at most, only use it as a second factor for two-factor authentication. More generally, don't use anything that removes your ability to make a choice under duress, in whichever direction you see fit, based on what you're protecting and what you're being threatened with. I find the ongoing case of someone being jailed indefinitely for refusing to supply a passphrase far more concerning than someone being compelled to supply a fingerprint.

JadeNB 11y ago
You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be. I think that it is possible to be an intelligent but non-technical person and (EDIT: forgot the word 'not') realise that, all technical issues aside, the "something you know" and "something you have" parts of a password are on completely different legal footing; and I think that it is reasonable even for a technical person to wonder whether it should be so. EDIT: I know that complaints about downvotes are not welcome, and it's quite possible that I'm wrong in what I say, but I'd like to be told how rather than just downvoted! My comment was meant to be a constructive contribution. EDIT 2: Wow, these many replies help a lot! Thanks!
- JoshTriplett 11y ago
  I agree with the comments below: a fingerprint is a username, not a password. I don't have a problem with compelling the provision of identification given an appropriate warrant; I do have a problem with compelling the provision of information held only in someone's head, with or without a warrant.
  - EdHominem 11y ago
    But it's not being used as a username, it's being used as a password. (Or rather, a username and a password.) It's hacking to bypass even a trivial password, so similarly it should be unreasonable to compel disclosure of even a trivial password... They don't need your usename - your phone assumes it's you and only asks for the password... The fingerprint that they're seeking is not a username, it's a crappy password.
- dragonwriter 11y ago
  "Something you have" isn't part of a password, its an alternative, non-password factor; passwords are always "something you know". There is a trend to use biometrics in place of passwords, which is a convenience feature which compromises security, even though it is often misrepresented as a security feature. (Using biometrics as a second factor helps security, but there is a big difference between "and" and "or" security measures.)
  - m_eiman 11y ago
    A fingerprint can improve security in at least one way: it makes it impossible to shoulder-surf your password since you're not entering it.
- pc86 11y ago
  Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written.
  - JadeNB 11y ago
    > Courts are not (and should not be) interested in "the law as it should be." They are to interpret the law as it is written. I agree, but then neither are we the courts; and it is precisely the role of the commons to discuss the law as it should be, so that the legislative branch can, hopefully, enshrine that communal wisdom in the law as it is.
    - pc86 11y ago
      You are right, I misinterpreted your comment.
- gruyere 11y ago
  per your edit, you seem to forget you're at HN.
- eganist 11y ago
  > but I'd like to be told how rather than just downvoted! It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device.
  - JadeNB 11y ago
    Thank you for your response! > It's probably in the tone of your comment, which (though it isn't the case) implies that there's something wrong with the laws. Rather than endorsing or decrying the law, I meant only to suggest that a simple, factual description of the state of the law, while non-controversial, also doesn't address the question of whether the law is appropriate. I am not at all sure that it is; but I am also a naïf in these matters, which is why I appreciate the many users who responded to my request for clarification. > I'd edit and rephrase in your position, especially since your criticism isn't of the law but is rather of the education of users. To your point: if users of devices could be educated in-device about the security of different identification and authentication schemes, the user could take better ownership of the security of said user's device. Indeed, I think that the point you make (and generously attribute to me) is a good one orthogonal to any questions of the law; whether the law is good or bad in any particular sense, it is as it is, and will be so enforced, and users should be educated as far as possible about this when choosing whether and how to secure their devices.
- DannyBee 11y ago
  "You've described the state of the law as it is, but surely that doesn't address the issue of the law as it should be." Fingerprints and other things like them are 100% non-testimonial. The fifth amendment does not cover non-testimonial evidence (because it only covers being a witness against yourself). This has been law since the amendment was enacted, was the purpose of it, etc. So I suspect if you want the law to be something else, your problem isn't even with the courts or judges, it's with the founders :)
  - spdustin 11y ago
    Not true. There is an adage that the government can force you to produce the key to a lock, but not the combination to a safe. It just so happens that, today, the government can compel you to perform a physical gesture that, by proxy, happens to be used as a key on a device that normally accepts a combination. If it's been 48 hours since your finger was last applied to the Touch ID sensor on an iPhone, that "key" doesn't work any more. So, until the fingerprint is accepted by the courts as a "combination" (effectively, that's how the "common man" sees it, and which the courts treat as testimony-by-proxy) rather than a physical gesture (not testimony at all, and currently easily compelled), the only defense one has (if using Touch ID) is to stall for 48 hours.
    - DannyBee 11y ago
      Your adage is based on random supreme court dicta in Hubbell and Doe, and you know courts have gone either way. ;) So let's just both agree we are suggesting the world is a little more black and white than it is. I would not try to predict what would happen square-on today, given the splits involved.
- maxerickson 11y ago
  The OP states their opinion a couple of times, so surely that doesn't address the issue of the law as it should be. isn't a very good reply to what they said. That was my reasoning.
  - JadeNB 11y ago
    Thank you for the explanation. Aside from saying once that he was not bothered by this state of things, I took the poster to be mainly explaining the consequences of the law (don't act as if your fingerprint is as secure as your password) rather than specifically endorsing it.
    - JoshTriplett 11y ago
      I definitely wasn't just giving the current state of the law; I was offering the opinion that out of the pile of problems we do have with government overreach, surveillance, and lack of understanding of technology, this case seems perfectly reasonable and not worth worrying about. I'm not bothered by the compelled production of a fingerprint, given the due process of a warrant; I don't see any obvious reason why someone should expect otherwise from the law, nor any right or reasonable expectation this violates, and I don't think the law needs to change in that area. (I do see other issues associated with fingerprints, such as the retention of fingerprints from non-criminals cleared of all charges, but I don't see an issue that applies to this case.) I am bothered by (attempted) compelled production of a passphrase. And I see those as significantly different cases.
djsumdog 11y ago
The person who is being held indefinitely for not giving up his password is really frightening. They should either let him go or charge him with contempt of course/obstruction and issue time served! Even if you /know/ you don't have anything illegal on any of my encrypted devices, it's better to take a contempt of court charge than give up a password...because of what they might /find/ or possible things unrelated to an investigation that they can link to a crime (or what they can then plant).
- JoshTriplett 11y ago
  Contempt is a terrifying charge, because under current law, you can be jailed indefinitely for the same contempt charge for as long as you refuse to cooperate with whatever the court thinks you should cooperate with. There's no upper bound there. So that wouldn't solve the problem.
  - bitJericho 11y ago
    I don't think its a problem for someone actively breaking the law to be held indefinitely for contempt until they stop breaking the law. I thought being compelled to reveal a passphrase was no longer required.
    - themartorana 11y ago
      That's a problem for me. Charge and prosecute them or let them go. Indefinite detention without a fair and speedy trial is unquestionably unconstitutional.
      - bitJericho 11y ago
        Well imagine a criminal is holding a piece of your property or even a person and not revealing where that is. Do you think it's reasonable to hold them for 30 days and then let them go and say "ah well I guess you can return that/them if you want cuz you did your time." A charge of contempt is still a charge.
maaku 11y ago
> You can be compelled to provide fingerprints based on a warrant; I'm unsurprised (and not particularly bothered) that you can be compelled to use them on your own device. 5th amendment.
- eganist 11y ago
  Doesn't apply, and this isn't the first opinion to come to that conclusion either. http://pilotonline.com/news/local/crime/police-can-require-cellphone-fingerprint-not-pass-code/article_25373eb2-d719-5a6e-b677-656699a50168.html http://pilotonline.com/news/local/crime/police-can-require-c... 5th amendment appears to be restricted to what you know based on all available rulings thus far. A password would fall under "what you know."
curt15 11y ago
In the era of fast 3d printers, what stands in the way of just fashioning a suitable fake finger from the fingerprint?
- msbarnett 11y ago
  Nothing. The 3d printer is overkill. A fingerprint and a pack of gelatin is more than sufficient.
  - r00fus 11y ago
    Have you personally done or seen this done this then? Quality of the print production seems pretty important...
    - hengheng 11y ago
      Laser printers are perfectly fine. CCC demoed this a few years back: https://youtu.be/aGjGzqYgz0c https://youtu.be/aGjGzqYgz0c
    - berdario 11y ago
      https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in...
    - stcredzero 11y ago
      Mythbusters did it.
      - r00fus 11y ago
        Not on an iPhone.
- mikestew 11y ago
  You might have noticed that ABS plastic doesn't have a lot of similarities with human flesh. That's not to say that it can't be faked, just maybe not with a 3D printer: http://arstechnica.com/security/2014/09/fake-fingerprint-fools-iphone-6-touch-id-why-its-not-so-serious/ http://arstechnica.com/security/2014/09/fake-fingerprint-foo...
ianopolous 11y ago
This is why we need plausibly deniable dual login on all accounts, ala truecrypt.
- MichaelGG 11y ago
  The issue there is that if you aren't really being plausibly deniable (using the fake login), then the court will realise this. For instance, if they know you were using that laptop 1 day ago, but the timestamps on the instance you unlock are all from 2 months ago, they may deduce you are pulling this stunt.
  - paulddraper 11y ago
    And spoliation is illegal.
stcredzero 11y ago
You can be compelled to provide fingerprints based on a warrant; I'm unsurprised (and not particularly bothered) that you can be compelled to use them on your own device. I thought that fingerprints were to be provided to: 1) establish biometric proof of identity 2) establish the presence of a person in a particular place 3) establish a person handled a particular object Or does the law establish that the authorities can use fingerprints for evidence in any fashion? Could they use a scan of a fingerprint to etch a fake-fingerprint latex sheet to open your locked device?
- swyman 11y ago
  Where does that list come from?
  - stcredzero 11y ago
    I am not a police investigator or lawyer, but those are what I understand as a layman to be the uses of fingerprints in practice.
    - swyman 11y ago
      Sorry, I guess I just read your phrasing to have more authoritative intent than you were going for. As I (also not a lawyer) understand it, there's nothing in particular that limits how intermediate/circumstantial pieces of evidence can be used/combined to find more evidence as long as each piece of evidence in the chain was acquired legally.
- niij 11y ago
  I'm not sure where you're getting this list from. But, I think that #3 would be relevant in this case, as the person would have needed to handle the device to register their fingerprint.
spdustin 11y ago
Providing a fingerprint (identification) is different from imprinting your finger to unlock a device. It's been upheld in the past that passwords/passphrases used to unlock encrypted content are considered to be testimony (because it leads to the acquisition and collection of possibly protected "testimony"), and thus protected by the fifth amendment. In my opinion, there is no reason to see imprinting your finger on a sensor used to unlock your phone as anything other than an equivalent form of "testimony", and it should enjoy fifth amendment protection. I don't think it will be long before this exact definition finds its way to the U.S. Supreme Court.
- drags 11y ago
  My understanding is that the "testimony" would be in the text of the password: compelling someone to reveal the password could be self-incriminating if _the password itself_ led them to additional evidence (e.g. a password of "I hid the revolver in the Conservatory"). [1] I can't think of a case involving a fingerprint where there's a similar risk since the fingerprint is arbitrary data. [1] https://en.wikipedia.org/wiki/United_States_v._Hubbell#Summary_of_the_Act_of_Production_Doctrine https://en.wikipedia.org/wiki/United_States_v._Hubbell#Summa...
  - spdustin 11y ago
    The case law thus far has stated that compelling the decryption of a data storage device really hinges on this: What evidence is known by the prosecution to exist? In several cases, when the defendant makes known that incriminating evidence exists, or when the prosecution is independently aware of the existence of incriminating evidence (they saw the screen before you locked it, and testified that what they saw was evidence of a crime), the defendant was rightfully forced to decrypt the storage device. However, when the prosecution has no specific knowledge that the evidence they seek exists, US courts have ruled that the defendant cannot be compelled to decrypt the storage device, since doing so would be forcing the defendant to reveal that incriminating evidence actually exists. Applying your fingerprint to an iPhone is an act that, without argument, decrypts data on an encrypted storage media, as the act of applying your finger to the sensor instructs the device to retrieve the actual cryptographic information necessary (your passcode/passphrase, plus other hardware-specific data) to access the cleartext of the data. The more and more I think about this, the more confidant I am that a fingerprint, while "something you have", forces you to disclose, by proxy, "something you know" to your phone. I guess the question then is twofold: If you have a combination safe that may contain incriminatory evidence, and a safety deposit box that contains only the combination to your safe, can the courts compel you to give them the key to the safety deposit box? And if so, should they be able to?
samstave 11y ago
Fuck you. (The state, not you user: JoshTriplett) But I do NOT agree with your comment. Fuck the state. A state who is trying to use terror and fear and war and crime as an excuse for power is a fucked state - and I want no part of it. The fact is that it is a lame excuse for "security" to use ginger-prints as a "secure" access method to a device such as a phone and then for the state to force people to take finger prints as a sure-identity method, which, ostensibly, could then provide access to all their data and phones, etc. Tell me how that is fucking secure???? So the real argument is about privacy. DO I HAVE ANY OR NOT????

deleted 11y ago

[deleted]

AdmiralAsshat 11y ago

Always remember: your fingerprint is identification. You can be forced to identify yourself to law enforcement. Do not make it your password. Your password is something you know, not something you are.

djsumdog 11y ago
Something you know, and ... something you can forget.
cloudjacker 11y ago
Or just restart your iPhone.
- astrodust 11y ago
  I've heard more than one person say if you're going to have to surrender your phone, if there's even the risk of it, turn it off.
  - TazeTSchnitzel 11y ago
    If you turn off your iPhone, you can't use it again without entering your password, and you would have to do that consciously. On the other hand, your phone could otherwise be unlocked with just your fingerprint.
    - colejohnson66 11y ago
      Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? Or does it act like there's just a password?
      - thesimon 11y ago
        >Is there a way to know Touch ID is available, but can't be used because the device was just rebooted? I don't know the verbatim message, but it says something along the lines of "Passcode is required to enable Touch ID"

Aelinsaar 11y ago

This... makes sense. You can be compelled to produce your fingerprints, or a physical key, or really anything physical with a warrant. It's the issue of producing KNOWLEDGE from your mind alone that is really the issue most of us care about, or at least, it's a newer issue.

TazeTSchnitzel 11y ago

Touch ID is disabled when an iPhone initially powers on. So, if you want to prevent law enforcement compelling you to decrypt using your fingerprint, hold down the power button and then slide right to power off the phone. Now they need your password.

M4v3R 11y ago
PIN Code is also required when you fail to authenticate with Touch ID five times. So one could use the wrong finger a few times and that would solve the problem ;).
- TazeTSchnitzel 11y ago
  I've noticed that Touch ID is super brittle (at least on my own iPhone 5S), too. If your finger's slightly wet, that may be enough. Indeed, trying it now, if I lick my finger and then use it to try and unlock my iPhone a few times, it disables Touch ID and requires a passcode!
Lxr 11y ago
Unless you are prepared in advance, after they take your phone you likely won't have the chance to turn it off.
- r00fus 11y ago
  I shut off my device before every security checkpoint (i.e., airports) or whenever I get pulled over. Only takes a 5 seconds - inconvenience is worth it.
- gherkin0 11y ago
  There should also be a timer that puts the phones into require-password mode. So after a few hours they'll need more than a fingerprint. Maybe you should also have the option of setting up a "coercion fingerprint(s)", which if used to authenticate would put the phone into require-passcode mode. Then, if the court compels you to unlock your phone with your fingerprint, you can put yourself back into 5th amendment territory. Actually, in that last case, you might already be protected. If 9 if your fingers will force your phone to require a passcode, and only one will unlock it. Could the courts/police force you to disclose which finger is the one that unlocks? I'd imagine you could put them in a situation where they have to chose which finger you use (or manipulate your hand themselves) to perform the unlock action, and in that case they'd only have a 1/10 chance of actually getting what they want.

FussyZeus 11y ago

Hold the phone (heh): Touch ID is disabled after 24 hours, how in the world did they get a warrant to do this within that time frame? It says in the article that the phone was seized on Feb. 25.

deleted 11y ago
[deleted]
talmand 11y ago
I've always understood that getting a local judge to expedite a warrant for timely reasons is not unheard of.
bobwaycott 11y ago
I believe TouchID is disabled after 48 hours.
djrogers 11y ago
The warrant was issued when she was arrested - it would not be at all unusual for police to get warrants for things discovered during an arrest, nor would it be unusual for them to be prepared to request one.

rdudek 11y ago

Would they cut her finger off if she denied that request?

eganist 11y ago
No, they'd just hold her in contempt.
- randyrand 11y ago
  But after 48 hours she no longer has the means to unlock it with her fingerprint.
goda90 11y ago
More likely she'd be held in contempt of court, or charged with withholding evidence.
imtringued 11y ago
Which finger? You only have 5 tries until the device asks for a password.

dogecoinbase 11y ago

Needs to support a duress finger.

goda90 11y ago
Wouldn't using the duress finger result in some sort of destruction of evidence charge?
- dogecoinbase 11y ago
  As with most duress mechanisms, one would have to judge whether using it was better or worse than not -- I suppose ideally one would have two, one of which simply reenabled the passcode and would have some deniability (this is effectively already possible by using a nonstandard finger, unless LE has witnessed previous successful unlocks and can identify the finger which should be used), and one which initiated a wipe of the phone.

DannyBee 11y ago

I'm not sure why this is surprising, under current precedent,you can be forced to type in your password (https://articles.forensicfocus.com/2012/02/09/another-judge-rules-encryption-passphrase-not-testimonial-under-fifth-amendment-analysis/ https://articles.forensicfocus.com/2012/02/09/another-judge-... covers some cases, but there are a lot of cases). Touch ID is not really different. In general, one of the only reasons you won't be forced to type in your password is if the act of proving you have the password is somehow incriminating (IE there is a dispute over ownership, etc).

saboot 11y ago

Curious, what would happen if you purposefully damage your fingerprint? Say by forcing a burn on your finger using a stove top or car cigarette lighter.

cheepin 11y ago
That's a pretty painful option compared to just handling rough objects. I've rendered touchID almost entirely ineffective just by grip taping a skateboard. The answer to your question though is that, at least on the phone's side, it would require your passcode to login
bdcravens 11y ago
Mine stops working all the time, especially my right thumb.
Phlarp 11y ago
Well, that would hurt, and you would have to permanently damage the entire fingerprint-- as only a small section of the scanned print is really needed to make a match. IANAL: but I would imagine a sour faced judge could call it contempt or maybe destruction of evidence depending on the circumstances?

xoa 11y ago

While it would not be cost-free against law enforcement (as they could charge with contempt/destruction of evidence and so on) I hope as this sort of thing happens more often it pushes Apple to respond with a native coercion code system rather then requiring a jailbreak. Security has been improving at a nice clip in the last 5 years after significant stagnation, and bringing coercion codes to the general public seems like the next straight forward, logical improvement. Apple seems to already have the basic system level infrastructure in place since they store and register each of the five fingerprints separately and fire off appropriate different system events, which is why a jailbroken device can have an imperfect but reasonably effective one. Apple though could make it more user friendly, and have it be not just for Touch ID but also using a PIN. While law enforcement gets the most press, this is and growing threat from non-state actors as well as mobile devices become ever larger gateways to the public's private lives and finances. Apple would do everyone a service by blazing the trail here and sooner (iOS 10) rather then later.

maaku 11y ago

5th amendment: "No person shall be compelled in any criminal case to be a witness against himself." How does this not apply here?

icebraining 11y ago
Providing your fingerprint (or blood, or DNA) is not considered testimony.
- talles 11y ago
  But is kinda silly how "numeric passcodes are protected individual privacies, but fingerprints are not" in this case. The use of your blood or DNA in the case should dictate if it's applicable or not, not the nature of the evidence itself.
  - bendykstra 11y ago
    The purpose of the right against self-incrimination is to prevent forced confessions and torture. With that in mind, it makes sense to draw a line between compelling someone to provide their fingerprint or DNA and forcing someone to divulge something they know. When the state has the right to make someone talk, how does it go about it? Also, it's impossible to know whether someone actually knows the passcode to a device, so someone could end up imprisoned indefinitely just for forgetting a password.
- Lawtonfogle 11y ago
  Once they can read minds, what then? And this isn't just science fiction; I've read reports that a persons inner monologue is soon to be accessible because when you talk in your head, it causes ever so slight commands to be sent to the voice box, which in turn reacts slightly. Not enough to produce sound or even be noticeable to a person, but which technology is being developed to pick up on.
superuser2 11y ago
The same way a search warrant can force you to hand over your diary.

united893 11y ago

If you have five minutes, please see this short video from CGPGrey, which summarizes succinctly why access to your phone is akin to access to brain: > https://www.youtube.com/watch?v=VPBH1eW28mo https://www.youtube.com/watch?v=VPBH1eW28mo

harryh 11y ago
I don't think it makes that point well at all. It says that (kinda) but doesn't support the idea with any form of reasoning. In fact, it's a relatively minor point and not really the main point of the video at all. If you had access to my phone you could learn a great many things about me (most of them banal) but there are many many many thoughts in my head that don't exist on my phone in any form. Continued nerd insistence of your point is little more than fetishization of technology. There's a reason Obama used that word at sxsw. It connotes a level of obsession and overfocus that is, quite frankly, pretty creepy.

rdez6173 11y ago

Could it be argued that the knowledge of which finger (or part of your finger) you use for authentication is equivalent to a passcode?

drostie 11y ago
Maybe, but you get five tries before you get locked out, so even if your lawyer pleaded successfully with that, the judge could reasonably order that you try with, say, all the fingers of your right hand, or maybe both thumbs and index fingers, without forcing you to disclose that knowledge.
ihsw 11y ago
Conversely, is there anything preventing them from having you try all ten fingers?
- mynameisvlad 11y ago
  Yes, you are locked out after 5 incorrect prints. At that point, you need to use your passcode to unlock your phone. That said, even if they guess that you're most likely to use your thumb, there is still a chance you can't unlock the device, especially on pre-6S devices, since the sensor is a lot more finnicky.
- deleted 11y ago
  [deleted]
- simcop2387 11y ago
  Chance. It'll stop accepting them after 5 attempts according to other posters in this thread. Combine that with the fact you don't know if it read properly or not you really don't have good odds that you'll succeed.
  - mywittyname 11y ago
    Plus, I think you can use your knuckles too.

tn13 11y ago

Isn't this same as forcing a person to give testimony against herself ?

JoeAltmaier 11y ago
Its more like "what have you got in your pocket?"
bdcravens 11y ago
No more than if you were ordered to open the door or a safe for a search warrant.

tn13 11y ago

At this stage the lady may consider temporarily injuring her finger to the extent the iphone does not accept it and falls back to passphrase.

paulddraper 11y ago
Self mutilation might not be the best option. I think you'd be a sub par legal advisor.

diegorbaquero 11y ago

Power cycle it. Win.

bdcravens 11y ago
Then you get charged with tampering, even if found not guilty on other charges. Probably lesser charge, but not a "win".

kefka 11y ago

"Judge, Which finger am I required to try?" Edit: the question is a legal trap to kept from being held in contempt. After 2 or 3 scans, the device demands a password. By asking which finger, they have a 20% chance of getting right finger.

Matt3o12_ 11y ago
No, they have 5 tries, and most people use at least 2 fingers (I use 3) so you can unlock it with both hands. Furthermore, most people use at least their thumb. So if the judge said use your left and right thumb, the chance of succeeding would be a lot higher (statistically speaking). If you use, let's say, your pinky finger, the chance of a judge guessing the right fingerprint is even lower because he will try out the most obvious choices before that.

anigbrowl 11y ago

This doesn't seem that remarkable. It's one thing if you have the combination to a safe and won't give it up; the police will have to get into the safe some other way. On the other hand, if it locks with a physical key which you happen to keep on your belt, I doubt any court would think twice before ordering you to hand it over.

nkrisc 11y ago

I think what's interesting is they're forcing her to verify that it is in fact her phone or that she had access to it. Now, in the case of a phone it likely wouldn't be hard to prove that other ways, but what if it was an otherwise unidentifiable device? It would force her to effectively testify she owned it when the police might otherwise not be able to prove that.

drcube 11y ago

Don't the cops already have her fingerprints? This is partly why biometric authentication is useless. You're supposed to change passwords frequently. How do you change your fingerprints? Who chooses a password the cops already know, and anyone else who knows you has access to?

csense 11y ago

I think the idea of using fingerprints, retina scans, face recognition, etc. as an access token is a fascinating instance of how culture influences technology. These things are very poor candidates for access control because you need fuzzy statistical/ML/AI/CV recognition techniques (which means you have to worry about false positives and false negatives), and it's basically impossible to re-issue credentials in case of a compromise (changing someone's fingerprints or facial characteristics would require performing plastic surgery on the user!) But because of movies and TV, everyone "knows" that in the future we're supposed to have our technology unlocked by our fingerprints, so that's what drives people to buy and vendors to implement, regardless of how absurdly impractical it is if you actually stop to think about it for five seconds.

CardenB 11y ago
I think it's more about convenience than sci fi.
awqrre 11y ago
In cases where your username is not public, biometrics should not even be used as a "login name"... let alone password.
shawnz 11y ago
> But because of movies and TV, everyone "knows" that in the future we're supposed to have our technology unlocked by our fingerprints, so that's what drives people to buy and vendors to implement I, for one, would love fingerprint unlock on my phone. And it's not for any crazy sci-fi expectation -- I just don't see any other method of unlocking my phone which could be as quick and convenient as that. Facial unlock is another possibility, but what concerns me about that is how easily someone could produce a picture of my face.

bdcravens 11y ago

Mine won't accept my right thumb after a day or so. (other fingers seem to be ok though) Probably due to diabetes and the way my medical condition causes clubbing of the fingers (I just re-add that thumb over and over) If she ate a bunch of salt and swelled up a bit, it might have the same affect. Providing the finger scan isn't the same as promising it unlocks.

pessimizer 11y ago

A judge can have you force fed, put into a straitjacket and spitguard, or have people put their fingers up your asshole and vagina. The idea that they can't get you to touch a piece of plastic is absurd. I'd be surprised if they wouldn't sedate you in order to do it. As someone who has been anally probed by the state, I find it pleasantly surprising that they even think they need a warrant to force you to put your finger wherever they want. Do passwords really need to be simplified? Do we invariably have to envision the future as a place where we wave our arms around beams of light and gently touch secret symbols to make things work? Isn't that just a juvenile fantasy of being a magician? Was Excalibur the first touch ID?

spdustin 11y ago

For me, the ongoing question that needs to be addressed by the court is this: Is the content of your smartphone considered to be documentary evidence (something you have) or testimony (something you know). I know I'm mixing definitions of the something you have/know combination, but it's a difference without a distinction, IMHO. I tell my phone, either directly or indirectly, all sorts of things that I would not otherwise document. Locations I've visited, for example. That's something that, unless I've been surveilled, only I know. By unlocking the phone, have I allowed access to documentary evidence, or have I allowed access to an extension of my mind? Is a smartphone a privileged companion? Like an attorney, or a doctor, or a partner? The spousal communications privilege in the US protects the personal conversations I have with my wife from being disclosed via compelled testimony. If she tells me that she committed a crime, or vice-versa, the recipient of that communication cannot be compelled to testify against the utterer. Further, spousal testimonial privilege means that she could not be compelled to describe her observations if they may incriminate me. We have similar affordances in the US for communications with legal counsel, or with medical personnel. I'm going to go one step further and say that 95% of you, dear readers, tell or otherwise provide secrets to your phone that, if you somehow had to communicate to an actual person, you'd only be willing to tell your spouse, your doctor or your lawyer. To me, that makes my smartphone a privileged confidant. And because it routinely collects information that I do not directly provide it, even though I'm capable of observing and remembering it myself, it acts like (and I treat it like) an extension of my mind. An augmentation that increases the capacity of my own brain's memory. I'm not in the habit of committing crimes, though I (like most of you) have committed some infractions in the past (speeding, "TP-ing" a house, a bounced check - ahh, the indiscretions of youth). But the knowledge in my head and the communications I have with privileged recipients may, if taken out of context, be used as documentary evidence supporting any number of charges against me. For example, the fact that I went to Home Depot four times in one week over a year ago could support the charge that I had assembled some device that was later used in a violent crime. That's a scary place to be, isn't it? To know that you did nothing wrong, and yet the vague memories you have of visiting Home Depot last year have potentially been documented more thoroughly by your phone. Is the common man supposed to assume that a smartphone they bought just so their kids can FaceTime with their grandmother 1,500 miles away is silently surveilling them, and can be forced to disclose all manner of information about them? It's a new world, and the laws of the land are old. Legislation moves at a snails pace already, but compared to the rapidity of technological advancement, the law moves like the pitch drop experiment.

banach 11y ago

I guess this will just make (savvy) criminals turn Touch ID off on their iDevices.

ultim8k 11y ago

Judges just go fuck yourself.

DarkContinent 11y ago

The Constitutional right to not incriminate oneself was originally intended to prevent the government from engaging in Star Chamber-style interrogations, i. e. using physical force to extract information from a person. This case frankly doesn't seem any different from such forcible extraction.

randyrand 11y ago

Workaround for the common person: When compelled, try your other fingers first than the one you registered. Do not register your thumb. After 5 tries, your password is required.

cmurf 11y ago

Rubberhose fs, with a modification: two passcodes, one unlocks primary fs A. The other unlocks secondary fs B and causes the DEK for fs A to be wiped.

digler999 11y ago

>a criminal is holding a piece of your property thats what a fucking search warrant is for. are you dense ?

dang 11y ago
Personal attacks aren't allowed on HN. We ban accounts that do this; please don't do it again. We detached this comment from https://news.ycombinator.com/item?id=11613437 https://news.ycombinator.com/item?id=11613437 and marked it off-topic.
- digler999 11y ago
  duly noted. Sorry, I got too excited.