8 ms·
Court orders US Capitol rioter to unlock his laptop ‘with his face’
- kube-system 5y agoI don't use Windows Hello -- is there a setting that requires entry of a password instead of biometrics after a period of time or after a restart?
- filoleg 5y agoYes, you simply turn off windows hello or any other biometrics in settings, and the other alternatives suggested to you will be a password and a few others.
- kube-system 5y agoI don't mean entirely -- I mean conditionally. Like iOS and MacOS does. If you don't unlock them for a period or time, or after a restart (and a couple of other conditions), they will ask for a password even when you have biometric login enabled.
- filoleg 5y agoOh, my bad, I completely misunderstood the original question. The macOS comparison makes perfect sense. As far as I am aware, there is no easy way to make it happen. Maybe my googling skills are poor, but I wasn't able to find anything relevant to this, no matter what kind of queries I was trying. All I've found was just a bunch of complaints about Windows Hello either not working at all or something related.
- princesse 5y agoMy MBP requires the password to unlock touchID after a while, fwiw
- banana_giraffe 5y agoI think there's an AD policy that can do this, but there isn't a user-visible option to do it, in the settings "Windows Hello Face" is either on or off.
- justaman 5y agoMakes me want to disable the facial login for my iphone
- marceldegraaf 5y agoIf you ever need to, press the on/off button on your iPhone 5x in a row in quick succession. This will disable Face ID (or Touch ID on older models) and require you to unlock the phone with your PIN or passphrase. It also acts as a shortcut to Medical ID and Emergency SOS.
- fundamental 5y agoThe phenomena of compelling biometrics for unlocking devices doesn't seem to be a new problem. They present a convenience factor, but from a security standpoint there's issues with others being able to compel their usage, spoofing, and not being able to change your biometrics (not within reasonable constraints anyway).
- csunbird 5y agoI love Apple’s approach to this: You can force the phone to ask for a password, even if Face ID is enabled, by rapidly pressing power button a couple of times. Face ID will be disabled until next unlock, so that you can not be forced to unlock the phone with your face.
- BrianOnHN 5y agoI guess facial recognition is beyond printing a picture of his face?
- filoleg 5y agoYes. Modern facial recognition systems (not sure which specific one his laptop used though, so what I am saying below might not apply to this specific case in the OP) use 3D mapping to get not just a flat image, but try to reconstruct the shape of your head/face. That's why when you try to set up FaceID on an iPhone, it asks you to turn your head in a circle a few times, so that the system is able to get all the necessary sides and angles of your head to create the internal 3d model. Other people can most likely still unlock your device if they make a perfectly molded silicone mask of your head+face or something else similarly complex, but a photo of your face printed on a piece of paper wouldn't work.
- fundamental 5y agoSometimes, but it depends on the vendor. Generally a picture of someone is enough to recognize them. So, if the system is just a monocular RGB image capture, then there needs to be another layer to the system to address when a biometric is spoofed with something like a picture.
- kube-system 5y agoWindows Hello sensors use infrared, not visible light spectrum. Printed photos reproduce a visible light representation that you can see, but it is not visible to the infrared sensor in the computer. See the left examples: https://docs.microsoft.com/en-us/windows-hardware/design/images/hello5.png https://docs.microsoft.com/en-us/windows-hardware/design/ima...
- deleted 5y ago[deleted]
- mam2 5y agoThis is not quite in the spirit of the law. Americans should disable any biometric password.
- thenayr 5y agoJust letting it be known, this guy traveled to DC with guns in his car, returned home after the riots and threatened to kill his 16 year old daughter and 18 year old son if they spoke about his participation in the riot.
- ortusdux 5y agoBiometrics are not passwords, they are usernames. You can change passwords.
- Clubber 5y agoThey are authentication and authorization just like a username/password set. I don't see the Supreme Court allowing this if they won't allow compulsion of releasing a password. Right against self incrimination. Should be interesting though.
- therobot24 5y agoi think the difference is compelled speech - you don't have to 'say' your biometric user/pass combo
- ColinWright 5y agoQuoting: "Reffitt’s lawyer told CNN ...that the laptop is now unlocked."
- leereeves 5y ago> Right against self incrimination. You can be forced to submit to fingerprinting, which could also be incriminating.
- Clubber 5y agoThat's a good point, but those fingerprints aren't used to open say, a biometric safe. They are used to compare with fingerprints found at the scene of a crime. Here's some interesting copy on similar cases. https://arstechnica.com/tech-policy/2020/06/indiana-supreme-court-its-unconstitutional-to-force-phone-unlocking/ https://arstechnica.com/tech-policy/2020/06/indiana-supreme-...
- deleted 5y ago[deleted]
- 5y ago
- theandrewbailey 5y agoLesson: typing passwords isn't such an inconvenience after all.
- beej71 5y agoI don't see the practical difference between forcing someone to show self-incriminating evidence and forcing someone to unlock a box in possession of authorities that contains self-incriminating evidence.
- er4hn 5y agoI guess facial recognition systems should allow for a "distress" face that will lock the device being authenticated down further. Yes, clear violation of a legal order, but it's in the same spirit as TrueCrypt's "hidden volume" feature.
- dogma1138 5y agoOn an iPhone and some other devices you have attention detection your eyes have to be open for it to work. The question here is still how the court would actually see this.
- ksaj 5y agoSome people only have one eye. Perhaps you could just always squint one closed whenever you unlock your phone, after testing that your unsquinted face won't open it.
- andrew_ 5y agoThe rate at which law enforcement attempts to chip away at Constitutional Rights to pursue agendas is frightening. Perhaps it's always been this way, and I've only recently started to notice it.
- artemonster 5y agoRight for privacy is not a right to obstruct justice.
- jimbob45 5y agoThat’s some spicy doublespeak you’ve got there.
- artemonster 5y agoNo, but really. For instance, in germany there are super strict policies regrding privacy on your workplace - i.e your employer cannot spy/monitor your activities under veil of security or productivity. That said, if you are a systematic slacker the employer may use some of that said spying to prove that you are slacker in exceptional (and well founded) cases and court will accept that evidence. Seems like a working system for me. Employers still are not allowed to spy, slackers still can get punished, no apocalypse, no slippery slopes.
- andrew_ 5y agoWe're not talking about Germany. The parent article is clearly speaking about a situation within the United States.
- LeifCarrotson 5y agoThe fifth amendment reads: > No person ... shall be compelled in any criminal case to be a witness against himself If you could compel someone to testify against themself, that would surely expedite justice. But we've decided that's not actually just.
- jimbob45 5y agoArrested three weeks after the riot. What’s the chance he left anything incriminating on his laptop by that point?
- mjevans 5y agoUnder they assumption they're guilty: If they had remorse? Very little. If they believed the big lies and/or felt a superiority complex? Seems likely to me. I'll note that with the pretext of the individual being guilty I've already disqualified someone smart enough to not commit nor record evidence of having committed a crime.
- paulpauper 5y agoBiometrics has always been considered less secure. just more evidence of this. Making a mold of someone's face/print can thwart biometrics.
- nimbius 5y agofriendly reminder: biometrics are NOT COVERED under the fifth amendment. if courts can force you to surrender your blood in a DUI case, they can absolutely force you to use your fingers face toes and other body parts to unlock your laptop phone and PC. use a strong passphrase, 15 characters or longer.
- smhenderson 5y agoIn the state I live the police can not force you to give up blood in a DUI case. What they can do is take away your license for a year if you refuse. Since you don't have a constitutional right to drive or a driver's license they can do this without running afoul of the state or federal constitution. A subtle difference but then the law is filled with such subtleties. You are not wrong though, as far as we know now bio-metrics are not protected. But I think this is just until some ruling comes down from a superior court and sets a precedence one way or another. I'm sad to say I won't be surprised whichever way it turns out though.
- kirykl 5y agoDoes this mean if you cannot speak or type, and thus use your face as password, you have no protection against this type of self incrimination
- spywaregorilla 5y agoHow did you enter the data into the machine if you cannot interact with it?
- xutopia 5y agoI am not American but I wonder why this is an issue. I can understand refusing to do so when passing through customs but this person was accused of a crime. Shouldn't law enforcement be allowed to check inside the laptop for evidence of his involvement? I mean if the government comes in and arrest me at my home they are allowed by warrant to enter my home. Why should a laptop be any different?
- dreadlordbone 5y agoA pesky little thing called The Fifth Amendment.
- function_seven 5y agoSo what is the distinction between the following scenarios: 1. Checking to see if your fingerprint matches the pattern left on the stolen painting. 2. Checking to see if your DNA matches the DNA left under the victim's fingernails. 3. Checking to see if your face matches the face pattern stored on the laptop recovered during a search of your premises. 4. Checking to see if your fingerprint matches the pattern left in the Secure Enclave of the phone that was located near the scene of the crime via phone company records and GPS. These scenarios are all slightly different. I'm not saying this is or is not a 5th Amendment issue. Would really like to get a legal argument on the important distinction between #1/2 and #3/4.
- jjeaff 5y agoI thinks it's likely that you could "check to see if your fingerprint matches the one in your phone". But that is totally different than using your fingerprint to unlock the device and then take information off the device to prosecute you. However, it has been found a few times that biometrics aren't really protected. But in many cases a password can be. Because you can't be compelled to incriminate yourself with your own testimony per the 5th amendment.
- SAI_Peregrinus 5y agoNone of those involve self-incrimination, so I don't think any of them are protected under the 5th amendment. They're all just comparing physical evidence to the suspect's physical traits.
- deleted 5y ago[deleted]
- jcranmer 5y agoMy first thought is "why isn't this prohibited by the Fifth Amendment," and it seems that the court order actually answers that question already: "With respect to the Fifth Amendment, Reffitt's entering his password in to the Subject Device does not violate his privilege against self-incrimination, because his act of production would not be testimonial, since the only potentially testimonial component implicit in his act of producing the unlocked/unencrypted device is a foregone conclusion." In somewhat more detail, this is permissible because the act of unlocking his laptop does nothing that can be seen as incriminating himself: * The laptop is already known to exist, and known to be owned by the user. * What is being sought on the laptop [a video the defendant recorded at the event] is already known and admitted to exist, and it is known that the files in question are (at least were at one point in the past) on the laptop. * The video in question was prepared prior to the search warrant and investigation, so it's not a Fifth Amendment violation to produce it unless the production itself is potentially incriminating (see https://en.wikipedia.org/wiki/United_States_v._Hubbell https://en.wikipedia.org/wiki/United_States_v._Hubbell). But as mentioned above, the ability to produce the information isn't protected anymore, since there's no question that the individual could produce it. This feels like it ought to be a violation of the Fifth Amendment, but it seems that it's pretty long-standing precedent that there's really nothing here that would violate the Fifth Amendment. Were this password-protected, or even a locked box in a safe, there would similarly be no Fifth Amendment violation, and the biometric aspect of the request doesn't (nor should it) change the analysis meaningfully.
- Grieving 5y agoI'm curious, would it be a violation if they instead invoked the Fifth Amendment to protect other contents of the laptop not acknowledged to exist?
- ksaj 5y agoI was thinking along this lines, but then he would have to declare that there is something on that encrypted drive that is unrelated but still could be used to incriminate him. That seems like an unwise declaration to make.
- 5y ago
- yawaworht1978 5y agoOn one side this is a bit of karma, the rioters had their own interpretation of the constitution , now the government is using their interpretation. All jokes aside, no matter the mental gymnastics, 5th amendment etc, this is just bad and contributes to the erosion of civil rights. Say, you have some darknet drug marketplace admin account on a laptop, and the police suspects that, forcing you to unlock the machine is of course forcing you to self incriminate. Especially if you compare this to a street dealer, the non virtual dark web drug marketplace. Only the seller knows the deals of the past and where money and supply are stashed. Nobody can force him legally to disclose any of that. Meanwhile , the laptop guy, by unlocking the laptop will hand them on a silver plate: past transactions and sales, delivery addresses, vendor data. Both commit the same exact crime, one can't be forced to disclose a thing, the other can? You can try to sugarcoat this in any way you like, if this is not defended against, this will come back to bite many regular people, probably even some who support it. Think of divorce cases, the lawyers are very creative, rest assured they will exploit this as much they can.
- smhenderson 5y agoIf said street guy without the laptop kept paper records in a locked safe then those records would be subject to a search warrant and admissible as evidence. Don't get me wrong, I don't necessarily disagree with you and I'm not sure I like the fact that the safe's contents are fair game. But my understanding is that is how it currently works. So I have a hard time seeing a difference between records kept in a safe and records kept on a laptop.
- SAI_Peregrinus 5y agoBiometrics make good identifiers. They make horrible authenticators.