Ever since biometric authentication began rolling out across phones and laptops, security researchers and legal analysts have both warned that such security measures would not protect against federal searches. Until now, however, such issues had been largely theoretical. There have been a handful of cases in which iPhones or Android devices were unlocked via fingerprint, but none involving Apple’s newest Face ID technology — until apparently now.
Federal investigators working a child abuse case searched the home of Grant Michalski, a man later charged with possession of child pornography, according to Forbes. With a legal search warrant, the FBI was able to compel Michalski to unlock his phone using his face. This type of search has generally been upheld in US courts, and while few will shed tears over the arrest of a child porn collector, legal situations like this have implications for a vast number of scenarios.
Ordinarily, the 4th and 5th Amendments offer some protection against being forced to unlock a device. But there’s a distinction in federal law between something you know, which may be protected by your right to avoid self-incrimination, and something you are. In many ways, this makes sense. If a suspect in a crime is believed to be 6 feet tall and have red hair, and you happen to be a six-foot-tall ginger, you can’t reasonably argue that this represents information about yourself to which you have a right to privacy. Readily observable traits and characteristics aren’t protected information under the Bill of Rights. Previous case law has already established that the police have the right to collect your fingerprints without your consent, and biometric authentication is just an extension of the same concept. In recent years, the federal government has expanded its use of this approach, even attempting to unlock an iPhone using the fingerprint of a deceased victim.
There’s an additional issue to consider when contemplating the security of biometric authentication. US law gives substantial power to Border Patrol agents within 100 miles of a US border — and it turns out roughly 2/3 of Americans live within 100 miles of a border. There’s little chance of these laws being rolled back, either. The Supreme Court has recognized that phones are fundamentally different in terms of their implications for privacy when compared with older “effects” that people used to carry, like letters or a day planner. But it has not ruled that these devices are immune from the “something you are” versus “something you know” distinction that governs whether the government is violating your rights when requiring you to unlock a device via fingerprint or facial recognition.
Tapping the power button on an iPhone 5x will disable Touch ID, while Face ID can be disabled by holding the Side button at the same time as either the Volume Up or Volume Down buttons. This will require the device to be unlocked by passcode rather than relying solely on biometric authentication. We’re not going to say biometric authentication doesn’t count as security, but there are legal weaknesses to the approach that using a passcode avoids.
Microsoft: Bethesda Games ‘Either First or Better’ on Xbox, Not Exclusive
Microsoft's Tim Stuart doesn't think the company will try to cut PS5 gamers out of future Bethesda titles. The company wants Xbox to be the best destination for its games, but not the only one.
Fusion Reactor Sets Record By Running for 20 Seconds
A team from South Korea just made a major advancement — the Korea Superconducting Tokamak Advanced Research (KSTAR) device recently ran for 20 seconds. That might not sound impressive, but it doubles the previous record.
Apple’s M1 Positioning Mocks the Entire x86 Business Model
Apple is positioning its M1 quite differently from any CPU Intel or AMD has released. The long-term impact on the PC market could be significant.
TPM Trouble: Which PC Enthusiasts Are Allowed to Upgrade to Windows 11?
Microsoft's free upgrade to Windows 11 could wind up costing you money. Not for the OS, but for the additional hardware you'll need to run it.