thumb testimony —

Virginia judge: Police can demand a suspect unlock a phone with a fingerprint

But passcodes need not be divulged as per the Fifth Amendment, court says.

Virginia judge: Police can demand a suspect unlock a phone with a fingerprint

A Virginia Circuit Court judge ruled on Thursday that a person does not need to provide a passcode to unlock their phone for the police. The court also ruled that demanding a suspect to provide a fingerprint to unlock a phone would be constitutional.

The ruling calls into question the privacy of some iPhone 5S, 6, and 6 Plus users who have models equipped with TouchID, the fingerprint sensor that allows the user—and ideally only the user—to unlock the phone. It is possible for users to turn TouchID unlocking off and simply use a passcode, and Apple has provided certain extra protections to prevent TouchID privacy issues—requiring the entry of a passcode if the phone hasn't been used in 48 hours, for example. But if a suspect simply uses TouchID to open their phone, police could have a window to take advantage of that when apprehending them.

The case in question this week involved a man named David Baust, who was charged in February with trying to strangle his girlfriend. The Virginian Pilot reports that Baust's phone might contain video of the conflict but that his phone was locked with a passcode. Baust's attorney argued that passcodes are protected by the Fifth Amendment.

The judge agreed with Baust, though he noted in his written opinion that “giving police a fingerprint is akin to providing a DNA or handwriting sample or an actual key, which the law permits,” the Virginian Pilot reports. “A passcode, though, requires the defendant to divulge knowledge, which the law protects against.”

The ruling is interesting because it draws into relief the legal difference between a person's identity and their knowledge. The Fifth Amendment protects people from being forced to witness against themselves, and last year when Apple's TouchID fingerprint sensor was announced, Ars' sister site Wired noted that fingerprints may not have the same protection as passcodes. “A communication is 'testimonial' only when it reveals the contents of your mind,” Wired wrote. “We can’t invoke the privilege against self-incrimination to prevent the government from collecting biometrics like fingerprints, DNA samples, or voice exemplars. Why? Because the courts have decided that this evidence doesn’t reveal anything you know. It’s not testimonial.”

Ars has contacted Baust's attorney and will update if we hear any comment from him.

Channel Ars Technica