10 ms·
Police in Norway can now force you to unlock your phone without court warrant
- jimnotgym 9y agoDon't use a thumbprint scanner. Set a PIN. They can force you to put your thumb in the screen but they cannot force you to remember a PIN. OK their may be able to put you in prison for not handing over the PIN, but at least that is your decision. On some phones you can set a PIN that destroys everything....
- mtgx 9y agoThe argument that "we're allowed to force you to unlock your phone with your fingerprint, because we could physically force you to do it anyway" makes me think that the governments will eventually not give citizens a pass when they have a PIN number or passphrase either, once they develop the technology to read our thoughts. And the reason is the same: because they could physically force you to reveal it. That's such a shitty way of thinking about laws. Should men be allowed to beat women just because they are physically stronger, too? No, we've simply decided as a society that just because you can do something with physical force, doesn't mean you should be able to do it, and that it's illegal to do it. And this is why I think forcing you to unlock your phone with your fingerprint, just because in theory the policemen can hold you down and force your finger on the phone, is also an immoral law and an immoral way of thinking.
- dmoy 9y agoI don't know about Norwegian law, but in the US the fingerprint compelling doesn't have anything to other do with "we are physically capable of forcing you to do this". Rather, there's existing precedent that allows them to requisition your fingerprint, because historically it was only used for identification. The PIN has no such precedent. (Maybe it even falls underneath 5th amendment?) Again sorry, dunno what the parallel is in Norway/EU I couldn't read the article because there were giant Facebook, Twitter, etc logos overlayed on all the text in pure black.
- dpark 9y ago> The PIN has no such precedent. (Maybe it even falls underneath 5th amendment?) Not likely. I don't think the Supreme Court has decided this sort of case yet, but some lower courts have held that a suspect can be compelled to unlock a phone. The logic is that it's equivalent to compelling a suspect to unlock a safe.
- rocqua 9y agoAs I recall, PINs are like safe combinations. You cannot be compelled to reveal those (with a 'foregone conclusion' exception). This is because the code is 'testimony' in the sense that you are testifying you know the combination. Fingerprints are like keys. They are physical things. You can be compelled to produce a key. Similarly you can be compelled to produce your finger. Obvious I Am Not A Lawyer notification.
- dpark 9y agoI'm pretty sure that precedent says you can be compelled to unlock a safe with a combination lock. You don't have to reveal the combination but you can be forced to unlock the safe. Protection from self incrimination doesn't include refusal to turn over evidence. Edit: Maybe I'm misremembering. http://blogs.denverpost.com/crime/2012/01/05/why-criminals-should-always-use-combination-safes/3343/ http://blogs.denverpost.com/crime/2012/01/05/why-criminals-s...
- SomeStupidPoint 9y agoCan you compel a suspect to unlock a safe using a code, not a key?
- krastanov 9y agoNot inside the USA (but if you are at the border you can be refused entry in a tit-for-tat fashion - you might count that as compelling). The EFF FAQ has a lot more details.
- gnodar 9y ago> On some phones you can set a PIN that destroys everything Even better, you can set a pin to only destroy specific data. Less chance of arousing suspicion.
- giancarlostoro 9y agoWhat phones actually do that though? I wonder what happens if you tell a police officer you may hold data that they may not hold the security clearance to see through though? Those are legitimate cases, what happens then? Weird. Edit: I guess my case makes more sense as a question of what happens in the US in such a case, but the former question is a general one.
- willstrafach 9y agoSuch a device would usually have a standard label to indicate that fact.
- giancarlostoro 9y agoNot everything has such a label on it. People use work emails on their phones for example which could contain just about anything.
- willstrafach 9y agoOne might have unclass or SBU e-mail on their work phone but it would be very problematic if there was actual classified data on a "regular" device.
- valuearb 9y agoUse the wrong finger. Try it quickly 5 times and it locks, forcing the passcode. If they hold the correct finger down, twist the tip of the finger and try to roll it. Even better, train a non obvious finger for your passcode. After the last application of your thumb/index finger fails and forces the passcode, turn to them, shrug your shoulders and say I don't know why it didn't work.
- bitwize 9y agoI don't know if "obstruction of justice" is a thing in Norway but it wouldn't surprise me if shit like this were prosecutable.
- dpark 9y agoDespite the downvotes, your concern is legitimate. Refusal to comply with a legal order is typically a crime of its own. I'm sure someone will say that they'd just lie about which finger they set up. And sure, you can do that. But if you do it in sworn testimony, it's perjury.
- greglindahl 9y agoIn the US, you can get into a ton of trouble lying to the police even if it's not sworn testimony.
- likelynew 9y agoBut it's not lying here. It's intentional hiding of facts. Not saying it won't get anyone in trouble.
- ball_of_lint 9y agoJust never say "I agree to unlock my phone" or "I use <finger> to unlock my phone.
- valuearb 9y agoIt's definitely a gray area. But there is a huge difference between a court order requiring you to comply with unlocking your phone and a cop demanding to access your phone at a traffic stop. Zion the latter case, did you comply or not? Did you use the wrong finger or not? Did you intentionally resist or did the sensor fail to work properly/efficiently? Those are extremely difficult things to prove layer in court.
- pavement 9y agoBut they can't force you to use the fingerprint lock in the first place. Don't secure your phone with biometrics in Norway.
- zzo38computer 9y agoCan you have it require both a fingerprint and password? Perhaps, requiring a different password for each finger? That is why you need open-source, so that you can program it by yourself. Or to do like I, don't have cell phone. You can write notes on paper, even in code if you need to I suppose. Confuse thieves (including police, which count as thieves too in this case) by writing very confusing stuff.
- pavement 9y agoI haven't seen one that does both for the homescreen lock. But you'd always want the biometric verification last, since it provides a powerful clue about who can authenticate all the other layers of security on a mobile device.
- zzo38computer 9y agoThat is a good point yes. Either that or display the password prompt even if the biometric does not pass.
- deleted 9y ago[deleted]
- tyingq 9y agoGuess we now need support for a "distress print" that locks the phone to pin only. Use your distress finger when in need.
- Zigurd 9y agoUnlock with your middle finger. Three tries with your index and done.
- onion2k 9y agoAndroid (stock at least, but likely other flavours too) allows you to have multiple users on a device. Swipe down from the top a couple of times, then press the little blue User icon and set up a different user with a pass code for things you want to remain private. You could happily unlock your phone for the default user without giving up any private data. It's not a method of securing anything as it's just obscurity, but very few people would know about it or bother to look. It's very useful for having 'work stuff' and 'personal stuff' on one device.
- greglindahl 9y agoIf you aren't careful, you could end up getting charged with lying to police. That's a serious charge.
- pokemongoaway 9y agoI like the idea of dual booting with vanilla Android and CopperHeadOS. CopperheadOS could also have TrueCryptesque steg volumes. This would allow one to divide their testing and more sensitive data in different profiles. More importantly, you could turn off your phone and it would defaultly boot into the vanilla Android volume (especially good for customs/boarder crossing/TSA). Let me know if you want to help me prototype this :)
- hackermailman 9y agoA prototype exists from 2013 https://www.ccsl.carleton.ca/~askillen/mobiflage/ https://www.ccsl.carleton.ca/~askillen/mobiflage/ but if something like this became popular they would just find ways to discover the 'hidden' partition and force you to open it anyway, or make flashing consumer devices illegal or something.
- nyolfen 9y agoi don't really think they would, at least for a long time; these pushes only come when the measures they address have become trivially easy or default practice. most jihadis have no particular tech expertise, but anyone can install telegram (for example). doing some fringe deep nerd shit like dual booting with a steg volume on your phone will probably never be popular enough to warrant legal reaction, barring specific high-profile instances popping up in the news.
- sr2 9y agoThat's why all phones should have a decoy feature so that when asked to produce a password, you just give them the decoy pass, and it unlocks a clean profile with no way for them to find anything personal, and or incriminating.
- mvdwoord 9y agoI would prefer not to have such oppressive laws in place, for more than one reason.
- drdeadringer 9y agoHow many times can we effectively cry "The SOPA is coming!" before protest fatigue sets in? When the wolves are attempted into law over and again, something has to give and I'm not sure that corporate-congressional interest will be the first to blink.
- giancarlostoro 9y agoMy phone has a guest code. I think phones should just have profiles that are complex enough to where nobody could know if it's your main one or not. However, apparently someone somewhere holds a patent to this sort of thing and thus... One example I found off Google, though I've heard of others: https://arstechnica.com/gadgets/2012/10/nokia-patent-may-be-keeping-multiple-accounts-off-of-android-4-2-phones/ https://arstechnica.com/gadgets/2012/10/nokia-patent-may-be-...
- rsync 9y agoOne of the most unexpected aspects of the emerging global surveillance regime is how trivially easy it is to opt out of. All you have to do is leave your phone at home. The over reliance on consumer technology and social platforms by end users is unfortunate but expected. Seeing how law enforcement has become so lazy as to piggyback all of their investigatory efforts on top of it is truly stupefying...
- gberger 9y agoIs this sarcasm? Leaving your phone at home is equivalent to having no phone at all.
- ryanlol 9y agoI can call a Uber with my laptop, the UX isn't great but it works. What else do you need a phone for? (Is it a Uber or an Uber? Curiously, uber.com seems to use both.)
- samstave 9y agoan uber.
- chipperyman573 9y agoYou use Uber to call an Uber
- likelynew 9y agoI think OP is pointing our reliance on technology. This contrasts to say soviet era surveillance or in fiction like 1984 in which escaping from the surveillance is not easy.
- overdunk 9y agoIs this sarcasm? It's pretty nice not having a phone at all, and checking on the internet maybe once a day or less.
- collyw 9y ago
- GreaterFool 9y agoThis is about unlocking electronic equipment (phones) based on biometrics and not pin/passwords. I suppose the logic behind it is that the police are already allowed to do similar things. They can use physical force to restrain for instance. They can search one's possessions. Or consider fingerprinting. What would happen if one were to refuse getting fingerprinted and made trouble? Are police allowed to use force in that case?
- shostack 9y agoThe only reason police organizations are making it about biometrics is because they have an easier time getting that then getting laws changed to compel pin/password unlocking. But make no mistake, this is all about getting unfettered access to everything bit of data they can without a warrant. They saw an easy opening to circumvent existing laws and they jumped for it.
- ball_of_lint 9y agoWhich is terrifying. Its kind of a slippery slope argument, but how far is this from mandating universal backdoors in encryption?
- jopsen 9y ago> This is about unlocking electronic equipment (phones) based on biometrics and not pin/passwords That makes more sense... Similar to how the police can require you to unlock the trunk of your car. It's a physical key.
- GreaterFool 9y agoThis is about unlocking electronic equipment (phones) based on biometrics and not pin/passwords. I suppose the logic behind it is that the police are already allowed to do similar things. They can use physical force to restrain for instance. They can search one's possessions. Or consider fingerprinting. What would happen if one were to refuse getting fingerprinted and made trouble? Are police allowed to use force in that case?
- sweden 9y agoI see a lot of people in this thread pulling the trigger of this "being an invasion of privacy". While this is true, I can't help but to feel that the Hacker News crowd tends of see only one side of this issue. They are not asking smartphone companies to introduce backdoors in their products. They are just trying to make sure that police has the right resources to be able to solve investigations. To be honest, this sounds reasonable to some extent. When someone gets questioned by the police, you expect the person to tell the truth. If the police gets a hint that your smartphone might have significant evidence of some sort of crime, isn't it reasonable to comply with the request? It's not like they are asking to access it remotely from anywhere at anytime.
- maaaats 9y agoThe problem is that as this stands, they can force almost anyone. They need probable cause to search my home, but not to unlock my phone. And I'd rather have them look through my clothes and possessions than all my mail and private conversations...
- ajmurmann 9y agoMeanwhile to search my house you need a search warrant. I'd feel more violated in my privacy by someone snooping through my phone or computer than by someone searching my house. With a search warrant this would be a different discussion.
- chronic61a 9y agoAgreed. Today is finally the day the beloved Norway does something that contradicts HN's mental model on how the world should work. Dear readers, enjoy the comments on this page. All of a sudden the HN crowd will begin advocating unwarranted searches.
- colmvp 9y ago> If the police gets a hint that your smartphone might have significant evidence of some sort of crime, isn't it reasonable to comply with the request? Sure, with a warrant.
- 9y ago
- EGreg 9y agoSmart criminals would not have everything accessible from a phone they take through customs.
- TazeTSchnitzel 9y agoIME an easy defeat for Touch ID, on the iPhone 5S at least, is to lick your fingers. Your phone will fail to unlock, and if you do it five times, your phone disables Touch ID for you. Another trick is to simply turn off the phone. Touch ID is always initially disabled at boot. I wish Apple would add a “duress finger” feature though.
- LyalinDotCom 9y ago"I wish Apple would add a “duress finger” feature though." that's a really good idea
- vanattab 9y agoWhat is a duress finger feature? A button to wipe the phone on the lock screen?
- TazeTSchnitzel 9y agoThe idea is that the phone would wipe itself/lock you out/whatever when you use a particular finger, rather than unlocking. So if made under duress to unlock the phone with your fingerprint, you use the previously-chosen “duress finger” rather than the normal one.
- vanattab 9y agoWhat happens if my friend/wife tries to unlock my phone and uses the wrong code?
- wodenokoto 9y agoI have a Samsung, but if I use an unregistered finger a few times it will hard lock. So, wouldn't you index go her essentially be your duress finger o. IOS?
- sondr3 9y agoI love being a Norwegian but damn, occasionally the government does some really dumb stuff. Like this. This is just like when they introduced the Data Retention Directive and whadda ya know, it's against human rights and now it's put on ice. I hope it'll happen with this directive.