Press to Unlock: How Biometric Phone Locks Endanger Fifth Amendment Rights and Individual Privacy

by Aaron Chow*

Today, nearly every individual carries at all times an extremely detailed account of their personal lives: the contents of their cell phone. Due to recent advances in biometric scanning technology, cell phones can now be unlocked with a mere touch of a finger. Federal courts are currently divided on whether law enforcement may compel these fingerprint scans in order to access the potentially incriminating contents of an accused’s cell phone. Because a vast majority of Fifth Amendment jurisprudence predates the advent of modern cell phones, it is ill-equipped to address the risk of self-incrimination and privacy violations that fingerprint locks create. This Contribution argues that federal courts must adapt historical precedent in order to prevent unconstrained cell phone searches and to safeguard Fifth Amendment rights.

---

More than ninety percent of American adults own cell phones, which are so ubiquitous that “the proverbial visitor from Mars might conclude they were an important feature of human anatomy.”¹ Cell phones frequently store addresses, text messages, financial data, and other sensitive information that could “reveal much more in combination than any isolated record.”² With the emergence of biometric scanning technology, cell phone owners can now unlock their devices with a mere touch of their finger.³ Law enforcement can in turn access sensitive information by compelling people to perform biometric fingerprint scans during criminal prosecutions.⁴ This forces suspects to turn over potentially incriminating information and violates their Fifth Amendment right against self-incrimination.

Under the Self-Incrimination Clause of the Fifth Amendment, no person “shall be compelled in any criminal case to be a witness against himself.”⁵ This fundamental right protects an accused “from having to reveal, directly or indirectly, his knowledge of facts relating him to the offense or from having to share his thoughts and beliefs with the Government.”⁶ To qualify for Fifth Amendment protection, an accused’s communication or act must be (1) compelled, (2) incriminating, and (3) testimonial.⁷ Forcing an accused to unlock their phone and subsequently obtaining evidence for use in prosecution is by definition both compelled and incriminating.⁸ Federal courts disagree, however, on whether a compelled fingerprint scan is a testimonial act.⁹

To be testimonial, an act or communication must “relate a factual assertion” or reveal information, either explicitly or implicitly.¹⁰ The Court in Doe v. United States distinguished non-testimonial and testimonial acts by drawing an analogy between two physical processes: surrendering the key to a strongbox and revealing the combination to a wall safe.¹¹ Compelling a physical act solely for identification purposes is like forcing a suspect to surrender a key to a strongbox. This is a non-testimonial act that does not violate the Fifth Amendment.¹² Forcing an accused to disclose the password to a safe, however, reveals information about their mental processes. This is a testimonial act protected by the Fifth Amendment.¹³

Courts holding that fingerprint scans are non-testimonial insist unlocking a phone is a purely physical act similar to surrendering a key to a strongbox.¹⁴ Courts holding the opposite emphasize that the physical nature of an act is not dispositive of a Fifth Amendment violation.¹⁵ Rather, the implicit disclosure of incriminating information resulting from a compelled act makes it testimonial, whether the act is physical or not.¹⁶ For example, when producing documents, a suspect may communicate incriminating information by implicitly admitting “that [incriminating] papers existed, were in his possession or control, and were authentic,”¹⁷ even though the act of production is a physical one.

Similarly, a successful fingerprint scan “confirms ownership or control of the device,” such that the authentication of any incriminating contents “cannot be reasonably refuted.”¹⁸ Unlocking a phone with a biometric scan therefore “equates to testimony that you have unlocked the phone before,”¹⁹ and can be tantamount to an admission of guilt if the accused’s phone contains incriminating material.²⁰

This implicit disclosure of information distinguishes compelled biometric scans from routine police fingerprinting, which requires witness corroboration or comparison to existing crime scene evidence to be effectual.²¹ And unlike biometric scans, identification fingerprints do not give law enforcement access to sensitive personal information.²² The same rationale applies when comparing other types of biometric locks like facial recognition or optical scans to the non-testimonial act of participating in a police lineup.²³ Compelled biometric scans provide a critical inference in the chain of evidence needed to prosecute an accused and are therefore testimonial.²⁴

Courts applying the Self-Incrimination Clause to compelled fingerprint scans also emphasize that biometric locks and passcodes serve the same purpose: securing a device and its contents.²⁵ It follows that if a person cannot be compelled to provide a passcode because it is a testimonial communication,²⁶ a person “cannot be compelled to provide one’s finger, thumb, . . . or other biometric feature to unlock that same device.”²⁷

Because these security measures are functionally identical, excluding forced biometric scans from Fifth Amendment protection leads to an incongruous and confusing result. If an accused protects their phone with only a passcode, a compelled unlocking would be a clear violation of their right against self-incrimination.²⁸ But if the same accused protects their phone with both a passcode and a fingerprint scan, a forced unlocking would raise no issue with respect to their Fifth Amendment rights.²⁹ Courts would inevitably reach opposite legal conclusions for two situations with an identical risk of self-incrimination.

Courts holding that biometric scans are non-testimonial reach this result when they place undue emphasis on (1) the physical nature of fingerprint scans, and (2) the analogy described in Doe’s dicta.³⁰ Because biometric locks serve the same purpose as passcodes,³¹ it does not make sense to compare forced fingerprint scans to the surrendering of a strongbox key. The Doe Court did not champion this portion of the analogy as a dispositive test of testimoniality.³² Rather, it included the example in a footnote in response to a comment from the dissent.³³ Physical keys do not fully emulate the function of modern biometric technologies, which the Doe Court could not have foreseen thirty years in advance. Compelling fingerprint scans effectively punishes people for implementing additional security measures on top of their passwords³⁴ and discourages further development of biometric technologies. In many ways, the convenience and protection offered by biometric scans exceeds that of passwords, which can be guessed, written down, or shared without the owner’s consent. A fingerprint lock or facial scan, by contrast, requires the owner to be physically present in order to unlock their phone.

To properly assess the risk of self-incrimination raised by biometric phone locks, federal courts should focus on two things. First, they should focus on the primary principle underlying the Doe decision and Fifth Amendment itself: preventing the “extortion of information from the accused.”³⁵ Second, they should focus on the guidance of more recent Supreme Court decisions, which account for new technological developments and their impact on fundamental rights.³⁶

The modern-day Supreme Court has recognized the significant privacy risks that unconstrained cell phone searches create and has encouraged greater protections to counteract these risks.³⁷ The Court held in Riley v. California that law enforcement must obtain a warrant to search a phone’s contents³⁸ and rejected proposed standards for searching phones that would give police officers “unbridled discretion to rummage at will among a person’s private effects.”³⁹ Even though its decision focused on the Fourth Amendment right against unreasonable search and seizure, the concerns raised by the Riley Court are equally pertinent to Fifth Amendment protections.⁴⁰ Biometric scans provide critical security to phones containing “some of the most intimate details of an individual’s life.”⁴¹ Allowing police officers to bypass these security measures would give them near-unrestricted access to potentially incriminating information, and would significantly increase the risk of privacy violations.⁴²

The Court has also emphasized that future decisions “must take account of more sophisticated systems” as new technologies “enhance[] the Government’s capacity to encroach upon areas normally guarded from inquisitive eyes.”⁴³ District courts at the forefront of technology litigation have taken up this charge by prohibiting self-incrimination through compelled fingerprint scans.⁴⁴ As the Northern District of California stated, “Courts have an obligation to safeguard constitutional rights and cannot permit those rights to be diminished merely due to the advancement of technology.”⁴⁵

Allowing compelled biometric scans would also lead to undesirable consequences beyond the criminal sphere.⁴⁶ Instead of requesting specific documents during discovery, parties to a civil investigation or dispute could seek a compelled fingerprint scan to gain access to an individual’s phone.⁴⁷ The phone could easily contain privileged messages, confidential information, or other incriminating material completely irrelevant to the dispute at issue.⁴⁸ Such overbroad discovery would promote conflict between parties and ultimately impose additional strain on judicial resources.

Courts recognize that law enforcement has an interest in accessing the contents of any electronic devices it lawfully seizes.⁴⁹ This interest, however, conflicts with the fundamental right against self-incrimination and individuals’ desire to maintain personal privacy.⁵⁰ Law enforcement does not need to compel biometric scans in order to obtain digital evidence from accused individuals, because alternative methods are equally viable and “do not trample on the Fifth Amendment.”⁵¹ For example, the Government can obtain digital communications between suspects from Facebook under the Stored Communications Act.⁵² Future courts must properly account for technological developments like biometric scans to protect the wealth of sensitive information everybody now carries in their pockets.

---

* Aaron Chow is a 3L at New York University School of Law. This piece is a commentary on the 2023 problem at the Cybersecurity Moot Court Competition hosted by the University of California, Los Angeles School of Law. The question presented was whether the Fifth Amendment allows law enforcement to compel biometric finger scans for the purpose of unlocking criminal suspects’ cell phones. This Contribution distills one side of the argument, and the views expressed herein do not necessarily represent the author’s views.

1. Riley v. California, 573 U.S. 373, 385, 395 (2014).

2. Id. at 394–95 (discussing the privacy concerns created by the vast amount of personal information kept on cell phones).

3. United States v. Barrera, 415 F. Supp. 3d 832, 833 (N.D. Ill. 2019).

4. See, e.g., id. (authorizing law enforcement to press the defendant’s fingers against his iPhone in order to unlock the device and access incriminating information).

5. U.S. Const. amend. V.

6. Doe v. United States, 487 U.S. 201, 213 (1988).

7. Hiibel v. Sixth Jud. Dist. Ct., 542 U.S. 177, 189 (2004).

8. See United States v. Hubbell, 530 U.S. 27, 38 (2000) (holding that incriminating information includes any communication or act that “furnish[es] a link in the chain of evidence needed to prosecute the [Fifth Amendment] claimant for a . . . crime”) (quoting Hoffman v. United States, 341 U.S. 479, 486 (1951)).

9. See Barrera, 415 F. Supp. 3d at 838 (collecting cases from various district and state courts that have adjudicated the issue of compelled biometric scans).

10. Doe, 487 U.S. at 210.

11. Id. at 210 n.9 (dicta).

12. See id. at 210 (collecting Supreme Court cases holding that compelled handwriting samples, voice samples, and participation in a lineup are not testimonial).

13. See Hubbell, 530 U.S. at 42–43 (holding that compelled document production has a testimonial aspect because of the mental processes involved).

14. See, e.g., State v. Diamond, 905 N.W.2d 870, 872 (Minn. 2018); Barrera, 415 F. Supp. 3d at 839.

15. See, e.g., In re Application for a Search Warrant, 236 F. Supp. 3d 1066, 1070–71 (N.D. Ill. 2017).

16. See Hiibel, 542 U.S. at 189 (holding that the act of producing documents may qualify as a testimonial assertion of fact when it confirms the existence, authenticity, or custody of an item the police seek).

17. Hubbell, 530 U.S. at 36 (quoting Doe, 487 U.S. at 209); see also Fisher v. United States, 425 U.S. 391, 410 (1976) (“The act of producing evidence . . . has communicative aspects of its own, wholly aside from the contents of the papers produced.”).

18. In re Search of a Residence in Oakland, 354 F. Supp. 3d 1010, 1016 (N.D. Cal. 2019) (holding that a compelled fingerprint scan to unlock a suspect’s cell phone violates the Fifth Amendment); see also In re Application for a Search Warrant, 236 F. Supp. 3d at 1073 (“With a touch of a finger, a suspect is testifying that he or she has accessed the phone before, at a minimum, to set up the fingerprint password capabilities.”).

19. United States v. Wright, 431 F. Supp. 3d 1175, 1187 (D. Nev. 2020).

20. See id. at 1187–88.

21. In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1016.

22. See Riley, 573 U.S. at 394–95 (discussing the privacy concerns created by the vast amount of personal information kept on cell phones).

23. In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1016 n.2.

24. See Kastigar v. United States, 406 U.S. 441, 445 (1972) (“[The Fifth Amendment] protects against any disclosures which . . . could be used in a criminal prosecution or could lead to other evidence that might be so used.”).

25. See, e.g., In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1015 (“[A] finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode . . . rendering them functionally equivalent.”); Wright, 431 F. Supp. 3d at 1187 (“[A] biometric feature is functionally the same as a passcode.”).

26. See United States v. Kirschner, 823 F. Supp. 2d 665, 669 (E.D. Mich. 2010) (holding that the compelled disclosure of a computer password would be testimonial and violate the defendant’s Fifth Amendment privilege).

27. In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1016.

28. See Kirschner, 823 F. Supp. 2d at 669 (holding that the compelled disclosure of a computer password would be testimonial and violate the defendant’s Fifth Amendment privilege).

29. See Barrera, 415 F. Supp. 3d at 833 (finding no Fifth Amendment violation in authorizing law enforcement to press the defendant’s fingers against his iPhone in order to unlock a device that also has a passcode).

30. See, e.g., id. at 839.

31. See, e.g., In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1015 (“[A] finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode . . . rendering them functionally equivalent.”); Wright, 431 F. Supp. 3d at 1187 (“[A] biometric feature is functionally the same as a passcode.”).

32. See Doe, 487 U.S. at 210 n.9 (dicta).

33. See id.

34. See In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1015–16 (noting that a biometric lock serves as an additional security feature to a passcode).

35. Doe, 487 U.S. at 211 (quoting Couch v. United States, 409 U.S. 322, 328 (1973)).

36. See Riley, 573 U.S. at 394–95 (discussing the privacy concerns created by the vast amount of personal information kept on cell phones).

37. See id.

38. Id. at 386.

39. Id. at 399 (quoting Arizona v. Gant, 556 U.S. 332, 345 (2009)).

40. In re Application for a Search Warrant, 236 F. Supp. 3d at 1073–74.

41. Id.

42. Id.

43. Carpenter v. United States, 138 S. Ct. 2206, 2214, 2218 (2018) (quoting Kyllo v. United States, 533 U.S. 27, 36 (2001)).

44. See, e.g., In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1015; In re Application for a Search Warrant, 236 F. Supp. 3d at 1073.

45. In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1014.

46. See McCarthy v. Arndstein, 266 U.S. 34, 40 (1924) (holding that Fifth Amendment privileges apply to civil proceedings).

47. See id.

48. See Riley, 573 U.S. at 394–95 (discussing the types of personal information regularly found on cell phones).

49. See In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1016.

50. Id.

51. Id.

52. Id.