In January, the United States Court of Appeals for the District of Columbia Circuit ruled in U.S. v. Brown that the FBI violated the Fifth Amendment privilege against self-incrimination when it compelled a man to unlock his phone with his thumbprint. This decision has created a circuit split on whether using biometrics to unlock a device violates the Fifth Amendment. The Supreme Court may eventually address this issue, potentially setting a national standard for such cases.
The implications of this potential Supreme Court case extend beyond personal privacy concerns and could impact searches of electronic devices at borders. Customs and Border Protection (CBP) officials currently have broad authority to inspect travelers' devices without warrants but cannot force travelers to provide passcodes. Concerns have been raised about viewpoint-based immigration enforcement actions, which might coerce individuals into unlocking their devices.
The central question is whether using a thumbprint to unlock a phone is "testimonial." The Fifth Amendment protects against self-incrimination, extending to statements and acts considered "testimonial," meaning they relate factual assertions or disclose information.
The D.C. Circuit applied this test in consolidated cases involving three co-defendants implicated in the January 6, 2021, U.S. Capitol attack. Peter Schwartz was compelled by the FBI to unlock his phone with his thumbprint after failing to provide the correct passcode, revealing incriminating messages. Schwartz argued that this act was testimonial and unconstitutional.
While it is established that disclosing a passcode is testimonial, the Supreme Court has not addressed whether using fingerprints or other biometrics falls under this category. In April, the Ninth Circuit ruled in U.S. v. Paynethat that such acts were not testimonial as they did not involve explicit communication or cognitive exertion.
Conversely, in U.S. v. Brown, the D.C. Circuit concluded that compelling Schwartz's thumbprint use was testimonial under both physical trait cases and act of production doctrine because it communicated ownership knowledge and access means akin to responding to questions about control over his phone.
This ruling could theoretically apply to other biometric security forms like Face ID but emphasized its reliance on specific case facts.
Meanwhile, questions arise about whether law enforcement can circumvent constitutional issues by spoofing fingerprints obtained during routine procedures like booking or border control checks.
Reports indicate fingerprint spoofing can be complex and device-specific, with varying success rates across different models due to sensor differences and operating system updates addressing vulnerabilities.
The D.C. Circuit decision highlights digital privacy protection challenges while posing critical questions about accessing sensitive personal information on phones without consent from owners.