FBI Forced Suspect To Unlock His iPhone X Through Face ID (engadget.com) 238
In what may be a world first, the FBI has forced a suspect to unlock his iPhone X using Apple's Face ID feature. From a report: Agents in Columbus, Ohio entered the home of 28-year-old Grant Michalski, who was suspected of child abuse, according to court documents spotted by Forbes. With a search warrant in hand, they forced him to put his face on front of the device to unlock it. They were then able to freely search for his photos, chats and any other potential evidence. The FBI started investigating Michalski after discovering his ad on Craigslist titled "taboo." Later, they discovered emails in which he discussed incest and sex with minors with another defendant, William Weekly.
Can they do that? (Score:2)
1. Can they do that legally?
2. Can this be avoided by changing your facial expression while the phone is shoved in your face?
Re: (Score:3, Informative)
2. No
Re: (Score:2)
For number 2, it shouldn't unlock if you close your eyes, which is a facial expression, so the answer is actually yes.
You have to have the "Require Attention" Setting set to "On", or else it doesn't require you to "pay attention" to achieve an Unlock.
And, short of the Ludvico Technique, I don't know if a Court can ORDER you to "Stare at Something".
Re: (Score:2)
Believe it or not, the FBI would make you open your eyes and try again. I know, hard to believe! But you know, they have a signed warrant and stuff so they will make you try again. I know, again, hard to believe you can't defy a signed warrant by closing your eyes.
Unless the Court Order Demands that you Open your Eyes, I'm not sure that LEO can FORCE you to stare at something.
Non-testimonial (Score:2)
Your looks are not considered 'something you know', ie. 'testimonial', so yes LEOs can force you to stare at your phone (or more accurately, lock you up for contempt until you comply).
A warrant is a court order (Score:2)
Unless the Court Order Demands that you Open your Eyes
The US Constitution prohibits only unreasonable searches. If a police department has shown probable cause to a judge and obtained a warrant to search a particular device with a particular owner, and this device is subject to a biometric lock, one might reasonably construe the warrant as a court order for the owner to authenticate to the device in good faith.
Re: (Score:3)
Unless the Court Order Demands that you Open your Eyes
The US Constitution prohibits only unreasonable searches. If a police department has shown probable cause to a judge and obtained a warrant to search a particular device with a particular owner, and this device is subject to a biometric lock, one might reasonably construe the warrant as a court order for the owner to authenticate to the device in good faith.
So the trick, if arrested, is to get the cops to beat up your face to the point of requiring reconstructive surgery, then FaceID would fail through no "bad faith" on your part...
Re: (Score:2)
If a police department has shown probable cause to a judge and obtained a warrant to search a particular device with a particular owner, ...
... then the owner is expected to stand aside while the police department searches and/or seizes the device, the legal system having decided to disregard the owner's property rights to the extent they deem necessary to conduct their investigation. That's it. Nothing about a warrant entitles law enforcement to the active assistance of the device's owner in either unlocking the device or translating any enciphered data into plaintext. That is not what warrants are for. The only thing a warrant gets them, lega
Re: (Score:2, Troll)
Re:Can they do that? (Score:5, Informative)
A warrant says they have the right to search your house, or in this case device. it doesn't compel you to unlock it for them
A warrant can compel you to provide "things you are". Such as fingerprints, DNA or opening your eyes for FaceID to work.
A warrant can not compel you to provide "things you know", such as an unlock code.....as long as you didn't write it down anywhere, 'cause they can get that paper.
Re: (Score:2)
You really should provide the disclaimer that you are not a lawyer because your advice is bullshit.
They absolutely can force you to provide the pin code or password, they do so routinely in the court system and the process is accepted under current supreme court precedent. If you refuse to provide them they can hold you in contempt of court and basically incarcerate you until you agree to provide them essentially up to life in prison and you can't appeal contempt of court rulings.
You might not like it that
Re: (Score:3)
Can you cite case law? This is still-actively-debated matter in U.S. [stackexchange.com]
P.S. I know it's already decided in U.K., but you Brits never had as much rights as we do anyway.
Re: (Score:3)
No, I read that there is a circuit split (U.S. v. Doe is ruling in 11th circuit, not SCOTUS) and until SCOTUS weighs on it, there is no definitive answer.
This is good enough for labeling "still actively debated matter", so I filed it away—I'll check back later when there is a relevant SCOTUS case. This isn't my day job.
Re: (Score:2)
I think you too need the NAL disclaimer, because that the 5th amendment prevents you from having to provide a password. United States Court of Appeals for the Eleventh Circuit [wikipedia.org]
The earlier 2010 case [wikipedia.org] was not the Supreme court, and in that case where no self incriminating evidence, could someone be forced to re-provide access to data (ie to persue others.)
So their is only a pretty narrow case law on if this is legal. It isn't well decided like you claim, and unless you can provide a Supreme Court case, as of
Re:Can they do that? (Score:5, Insightful)
In this case, he'd been much better off using a long, complex passphrase/code for phone access.
They can likely physically force you to touch it for fingerprint ID access, and they've shown they can force you to use FaceID....but so far, I don't think they can reach inside your brain to ferret out the passcode for access.
Hey, it sounds like they got a bad guy here....but just talking in principal, if you want your smart phone, in this case iPhone, to be as secure as possible, use a complex passcode and NOT the biometric stuff.
Re: (Score:2)
Well, one thing to do is.....DO NOT USE biometrics to access your phone.,
In this case, he'd been much better off using a long, complex passphrase/code for phone access.
Yeah, but do you want it convenient or secure?
Re: (Score:2)
Well, one thing to do is.....DO NOT USE biometrics to access your phone.,
In this case, he'd been much better off using a long, complex passphrase/code for phone access.
Yeah, but do you want it convenient or secure?
Always the trade-off, and depends on the threats that you are defending against. Petty thieves are not particularly going to care about your data, they just want a phone to sell, so a fingerprint lock here is a good solution as it's easy to use all the time, and secure enough when you are separated from your phone. Biometrics are better for this case as you are much more likely to use them consistently than a long password.
Re: (Score:2)
Re: (Score:2)
but so far, I don't think they can reach inside your brain to ferret out the passcode for access.
Sure, but they can also jail you indefinitely [theguardian.com] until you cooperate.
Re: (Score:2)
A warrant says they have the right to search your house, or in this case device. it doesn't compel you to unlock it for them. it is up to the FBI to find their own key, which might mean just bashing down the door with a battering ram if you refuse to unlock it for them.
In this case the key is holding the thing in front of your face. Or possibly your kids face.
They did find the key, staring them in the face (Score:4, Insightful)
> it is up to the FBI to find their own key,
It seems to me they did find the key. It was staring them right in the face, literally.
A lawful court order cannot compel a defendant to TESTIFY. It CAN compel someone to do things. It is common for an order to compel someone to turn over some evidence. If they have hidden it, or locked it up, "turn over" the evidence means get it from its hiding place, or unlock the safe it is in, or whatever is required in order to bring the evidence to the court.
That may not have been necessary in this case, as the FBI could hold the phone up to his face. The defendant only needed to be present, not say or do anything.
Re: (Score:2)
Re: (Score:2)
Wait a sec.
Making a law (Score:3)
Making a federal law legalizing abortion would in no way remove the question from the purview of the SCOTUS. Row v Wade is a decision on the issue of constitutionality of such laws, be they state, local, or federal. A federal law would be just as subject to the constitutionality determination as any other law.
Re: (Score:2)
Roe v Wade effectively wrote federal law. If we instead had an actual federal law, then any constitutional challenge to such a law would have a very high bar to clear, as the Constitution says nothing about the topic at all, and by modern interpretation everything is interstate trade. There would be no need to invoke "penunbras" or any such BS if the Dems had the courage to pass a simple law. But of course they don't want to: that would deprive them of their biggest issue.
Re: (Score:3)
Re: (Score:2)
Does it not eventually lock for ever longer periods of time if you keep deliberately messing it up?
Re: (Score:2)
Does it not eventually lock for ever longer periods of time if you keep deliberately messing it up?
Yep. But some of that stuff has to be enabled by the User.
Re: (Score:2)
Does it not eventually lock for ever longer periods of time if you keep deliberately messing it up?
It eventually requires a passcode if it fails enough times, but if the police have a valid warrant requiring that you present something that is undeniably in your possession (e.g. your fingerprint, your face with a neutral expression, etc.), you're legally obligated to do so. Failing to deliver the thing could be viewed as obstructing an investigation. If your device gets locked behind a passcode because you intentionally botched it enough times, you would have tampered with evidence. The fact that you're r
Re: Can they do that? (Score:2)
Re: (Score:2)
Who cares? Good luck trying to avoid a search warrant by not cooperating.
I wouldn't try to avoid one... ... unless I was being accused of a very serious crime to which I was not guilty... actually, I guess if I was guilty I'd try and not cooperate too (I just don't see myself ever guilty of a serious crime).
Re: (Score:2)
I don't remember my pass code. Sorry. Never use fingerprint or facial scan.
don't remember? (Score:2)
A 'determiner of fact' (aka a judge) will assess your claim of forgetfulness. Then he (or she) will find you guilty of contemp of court, and away you go to jail until you 'remember'.
Of course, you can appeal the decision while you are in the pokey, but, realistically, good luck with that.
Re: (Score:2)
Re: (Score:2)
You seem to have a deep misunderstanding of what a search warrant is. It allows the government to search; it does not compel you to cooperate.
The police can use biometrics against your will, things that you are not things that you do, but they cannot compel you to disclose e.g. the combination to a safe. They can, of course, just cut the safe open.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And what if you refuse?
Then the judge who issued the warrant will be very angry with you, and he has the authority to imprison you until you do.
Re: (Score:2)
Re: (Score:2)
I know I can keep my eyes closes as long as I want.
Re: (Score:2)
I know I can keep my eyes closes as long as I want.
They can be verrrry sneaky. All of them be quiet and when you have a look to see if they're still there, BAM phone in the face, gotchya! XD
Re: (Score:2)
Re: (Score:2)
Easiest way is to simply disable face ID before you are arrested. It's a simple and a press and hold of the side and volume button. Once that is done the passphrase must be provided.
Re: (Score:2)
It takes you 48 hours to press a button? (Score:2)
Re: (Score:2)
The easiest way, is to NOT use face ID or even fingerprint ID at all.
Just use a sufficiently complex and lengthy passphrase to unlock your phone.
It is much harder legally for them to compel you to reveal that.
Re: (Score:2)
The easiest way, is to NOT use face ID or even fingerprint ID at all.
Just use a sufficiently complex and lengthy passphrase to unlock your phone.
It is much harder legally for them to compel you to reveal that.
Use lots and lots of special characters and instead of naming the character describe what it looks like XD
Even easier (Score:2)
Don't be a criminal.
Press and hold (Score:2)
This is very interesting. How long does it take? Is that something you could realistically do while an FBI agent was at your front door asking you to identify yourself? If a criminal was ready, maybe he could reach into his pocket and surreptitiously do this?
Problematically, he would probably open himself to additional charges for obstruction of justice.
Re: (Score:2)
It takes about 1 second to do. The few times I've been stopped by police I always do this before they reach my car. This ensures any strangeness that may happen has a layer of protection.
1 second (Score:2)
Nice.
Re:Can they do that? (Score:5, Interesting)
Yet another FUD headline.
The FBI did not force the suspect to do anything. The search warrant signed by a judge forced the suspect to unlock the phone.
Re:Can they do that? (Score:5, Insightful)
I'm sure that piece of paper held the phone to his face and made him not move too.
Re: (Score:2)
Re: (Score:3)
Re:Can they do that? (Score:5, Insightful)
Or, this is why you don't advertise child porn/abuse on Craigslist.
Re: (Score:2)
Or, this is why you don't advertise child porn/abuse on Craigslist.
Indeed.
Although, wrongful arrests can happen and coincidental evidence on your phone can be used against you; or something such as a joke text be misconstrued. The photo of you baby taking a bath could be said to be taken to be child porn. I don't know... all sorts of things could be used against you even if not really what they seem.
I use biometric logging on my phone... I don't do anything illegal (well besides breaking the speed limit occasionally)... I don't do anything I think could be mistaken for i
Re: (Score:2)
This is why you set a password/pin - you can be 'legally' compelled by law enforcement with nearly unlimited force to use biometric authentication, but they aren't yet allowed to force you to type in a password outside of some narrow circumstances (which are being rapidly expanded), at penalty of sitting in jail forever under contempt of court. TrueCrypt had nice partial solutions to this using hidden volumes.
I don't see the difference myself. Either they should be allowed to force you to unlock the phone or they should not be allowed to force you to unlock the phone. The method of lock shouldn't matter.
Re: (Score:2)
The difference is between something physical (a fingerprint, face, or key) and something which is knowledge (PIN or combination). They can get physical things via warrant or subpoena (inc. papers and possessions), but not knowledge (protected by 5th A).
Re: (Score:3)
I don't see the difference myself. Either they should be allowed to force you to unlock the phone or they should not be allowed to force you to unlock the phone. The method of lock shouldn't matter.
The difference is one requires you to divulge knowledge, the others don't. Your face and fingerprints are not protected, as shown by the fact that police can use photos and fingerprints without your consent as evidence in court. The reasoning around passwords is that it would require the person to testify against themselves. It's a tenuous argument and hasn't been fully tested legally.
Re: (Score:3)
Hopefully Apple builds in some kind of ability for the facial recognition system to be told to require an additional password (or other credentials) if a user looks at it in a certain way or
Re: (Score:2)
They would have to destroy a lot of your rights to force you to put in a code.
Re: (Score:2)
The courts have always been allowed to force you to reveal a password, there is work going on to roll this back but the sad fact is the supreme court ruled many years ago (back in the 80's) that the pa sword to a computer was no different than the lock to a safe and it could be compelled. Passwords and pin codes are routinely forced by courts to be disclosed.
Now that we have things like smartphones that contain literally your entire life there is talk about rolling this power back and requiring high standar
Re: (Score:2)
on 2 just slam your face into the jail door / wall / bars are few times.
Re: (Score:2)
So instead they throw him in jail for contempt of court for not giving up the password when presented with a proper search warrant signed by a judge.
What's the difference?
Probably depending on how serious the crime is. In his case assuming his phone had evidence against him. His crime was way more serious than any crime for contempt of court. If they didn't have strong evidence against him otherwise- he's probably best taking the contempt of court rather than a decade in the slammer.
the difference? (Score:2)
Passwords are 'testimonial'.
Yes, he would certainly still get locked up. It would be much harder to secure a conviction against him, though. And he would be more likely to get during the pretrial period. Also, any conviction would be much more likely to be overturned at the appellate level.
It is better to serve two years and have the conviction overturned than to serve one year and have the conviction stick. Although that last part is not really super-relevant in this particular case.
Re: (Score:2)
Oh, a private cell. How luxurious!
Chose the wrong part of 2-factor auth (Score:5, Insightful)
Dear ... (Score:3)
Dear sexual predators, rapists, pedos et. al. Please don't use your stupid face or your fingerprint to lock your evidence phone. Use a looooong password.
Otherwise we'll get these stupid articles every other day.
Re: (Score:2)
Yeah, next you will be telling them not to have incriminating evidence on a phone they carry around with them, or send messages with illegal content from their personal device.
Re: (Score:2)
Dear sexual predators, rapists, pedos et. al. Please don't use your stupid face or your fingerprint to lock your evidence phone. Use a looooong password.
Otherwise we'll get these stupid articles every other day.
I hope people who are really guilty DO use these methods of locking their phones. I'd rather predators go to jail than slashdotters getting to avoid seeing these stories.
Re: (Score:2)
Um.....I'd actually prefer such people use their face or fingerprint....or not lock their phones at all. And tell the local police about their "activities".
obXKCD (Score:4, Funny)
Re: (Score:3)
Even easier: obtain a search warrant signed by a judge.
Re: (Score:2)
Re: (Score:2)
In any town of substantial size, there's always an on-call judge for this kind of thing.
Re: (Score:2)
Knew this was coming (Score:5, Insightful)
In what may be a world first, the FBI has forced a suspect to unlock his iPhone X using Apple's Face ID feature.
Could see this coming. No different logically from forcing someone to unlock with a fingerprint which they've already done and gotten judicial cover for. If you want to keep it private best to require a code (that only you know) to unlock which US courts have upheld as a valid 5th amendment defense.
My 1 year old daughter recently unlocked my wife's phone when my wife was standing behind her so that should give you a good idea how secure it is. It's the rough equivalent to a tiny luggage lock. Useful for keeping out the most causal snoopers but not really serious security.
Protips (Score:2)
If you don't want "the government" to use your face (or finger) to unlock your iPhone with a warrant, don't use Face ID (or Touch ID).
Use a strong passphrase instead, which you cannot be compelled to provide under the 5th Amendment.
Or, alternatively, don't be a murderer, child sex trafficker, or child pornographer. And no, that's not a different version of "if you have done nothing wrong, you have nothing to hide"; it's a literal recommendation.
Expansion of definition of CP (Score:2)
Or, alternatively, don't be a murderer, child sex trafficker, or child pornographer.
This sort of recommendation works to a point. This point is when the legislature expands the definition of child pornography to cover possession of things that were not previously illegal, such as non-photorealistic drawn porn.
Re: (Score:2)
I'm OK with any definition of child porn expanding as far as it can go.
Let's say the legislature defines "child" as under 95 for the purpose of a porn ban. Now practically all the porn on most people's drives is illegal. Is that how far you want to expand it? Would you also want to ban The Bible and Nabokov's Lolita?
Quickly disable Face/Touch ID (Score:5, Informative)
On FaceID devices, hold a volume button + lock button for a couple seconds then press cancel. FaceID will now be disabled until you enter your PIN.
For TouchID devices, hold the lock button for a couple seconds and then press cancel.
Re: Quickly disable Face/Touch ID (Score:2)
With a search warrant in hand... (Score:3, Insightful)
So what is the problem here?
If it was a properly obtained search warrant, what the police did was equally proper. If you have a locker or a storage area with a lock on it and the police have a search warrant, you can either open the lock yourself (or 'forced to' as per the article) or they can get out a set of bolt cutters and remove the lock themselves.
If the warrant was not obtained properly, then the fruits of the search are inadmissible as well as any other evidence obtained as a result of the search.
The courts have routinely ruled that you cannot be compelled to turn over your passwords as that information is inside your head but that physical protections are not so covered.
As an aside, this is the reason biometrics is not really a good way to secure anything -- you have the person, you have the biometrics. Whether it is police or the mob, you can 'force' someone to unlock their devices with a fingerprint, retina scan, or facial recognition. This is a corollary to the hackers rules: if you have physical access, no security measure is 'secure.'
If you want your device legally secured, only the information inside your head is sacrosanct, Your device will just be confiscated until they are able to hack into it by different methods. Although I am not a lawyer, I would guess that the act of not unlocking a device for a warranted search probably stops the clock on statute of limitations as well, so if it takes five years to hack your device, you will surely still be on the hook for it.
Re: (Score:2)
Or you have a safe that burns the contents when forced, so if you don't open it you don't incriminate yourself.
Re: (Score:2)
As an aside, this is the reason biometrics is not really a good way to secure anything
It depends on what you are trying to secure. My phone doesn't have evidence of a crime on it, so all I really want to do is keep out people who may find my phone after I lose it somewhere.
Whether it is police or the mob, you can 'force' someone to unlock their devices with a fingerprint, retina scan, or facial recognition
You do realize that the mob has....alternative means to compel you to give up your password, right?
Mug Shot (Score:2)
Re: (Score:2)
Just say lawyer over and over (Score:2)
Just say lawyer over and over and refuse to do anything until they let you use your right to talk to one.
The takeaway: Don't use facial recognition (Score:2)
A simple solution ... (Score:2)
... is to make sure you don't carry incriminating material in your wallet or purse. Remember those?
They have been subjected to search since Moby Dick was a minnow.
How long did it take for people to wise up to that?
As technology gets smarter, people become dumber.
If you have an iPhone, use "rape whistle mode" (Score:2)
Siri Shortcuts to the rescue (Score:2)
There is already a published Siri shortcut called "I am being pulled over by the police" which performs a number of actions to record your interaction with the police including notifying contacts and even publish the video.
I imagine that one of the options could be to disable faceID or touchID.
Someone should write one that's like: "Hey Siri, BUG OUT!!!" which would promptly erase the phone.
Re: (Score:3)
Re:Cue all the libtards bitching about his "rights (Score:4, Informative)
Re: (Score:2)
What hole? (Score:2)
Re: (Score:2)
Re: (Score:2)
TIL that far to many people confuse a job interview with a trial.
And also those same people are very, very, very, very horrified by people lying under oath.....but only when it's the other "team" lying.
Re: (Score:2)
In a job interview? Honestly, if three different women testified under oath that a job candidate might have something to do with serial rape and was present at an attempted rape, you would just let go, not even want to investigate this further and hire the candidate right away?
Depends on whether the accuser was even remotely credible. For example, if everyone else she claimed was there disagreed, then there's not enough there. Even then, if the guy had passed 6 FBI background checks, there seems little point in another one.
But of course that's not what the current circus in DC is about at all: it's entirely a sham to delay confirmation until after the election.