ACTIONS SPEAK LOUDER THAN WORDS: COMPELLED BIOMETRIC DECRYPTION IS A TESTIMONIAL ACT.

• Author: Zimmerling, Aubrey

Introduction

Suppose during a criminal investigation, the police lawfully seize a suspect's iPhone and have a valid warrant to search it for evidence. The police, however, are unable to execute the search warrant because the iPhone is encrypted--it requires a password to unlock the device. In response, law enforcement obtains a court order compelling the suspect to unlock the phone. The suspect then attempts to invoke her Fifth Amendment right against self-incrimination, arguing that unlocking the device would force her "to be a witness against h[er]self." (1) Is the suspect protected by the Fifth Amendment? As the law currently stands, a court's answer would depend on whether she uses her finger to type in the passcode or if her finger is the passcode itself.

Biometric decryption first integrated itself into consumer technology in 2013 when Apple's iPhone 5S offered a new security feature called Touch ID. (2) With Touch ID, the iPhone could capture high resolution photos of the user's fingerprints and then use those to unlock the device in lieu of a traditional alphanumeric password consisting of numbers, letters, and symbols. (3) Four years later, Apple unveiled Touch ID's cousin, Face ID, which uses a "TrueDepth" camera to project thousands of infrared dots onto a user's face, mapping out their unique combination of facial curvatures and creases. (4) Today, over 85% of Americans own a smartphone, (5) and most of those smartphones enable biometric security features like Touch ID or Face ID. (6) In a relatively short time span, biometric-based decryption (i.e., using a fingerprint, facial scan, iris/retina scan, voice recognition, etc. to unlock a device (7)) has become ubiquitous in consumer technology, meaning many Americans now unlock their phone with their finger, not by typing in a passcode, but as the passcode itself.

The benefits biometric passwords provide in the way of convenience and enhanced data security have come at an unexpected cost. (8) In the previous hypothetical scenario, if the suspect's iPhone requires an alphanumeric password, she is likely eligible for Fifth Amendment protection. (9) If the suspect's iPhone requires a biometric password, however, in many jurisdictions, she would be ineligible for Fifth Amendment protection. (10) Legislative Attorney Michael A. Foster encapsulates the situation well: "Courts have reached conflicting conclusions [regarding] compelled decryption [and] the Fifth Amendment. And perhaps counterintuitively, the trend appears to favor recognizing more constitutional protection for password-protected devices than for devices protected by a biometric identifier." (11) As a result, the legal issue of compelled biometric decryption--where a suspect is forced (e.g., by court order) to unlock her device using a biometric identifier (e.g., a fingerprint)--"presents the twenty-first-century citizen with a disclosure quandary:... information security or constitutional protection...." (12)

In the absence of Supreme Court precedent, lower courts have struggled to apply outdated caselaw to these novel legal issues, and they must operate without a "consistent unified theory" to settle disagreements on "how these cases should be decided." (13) Because this technology has been "integrated into everyday life" (14) and has created modern loopholes in traditional constitutional safeguards, the need for Supreme Court guidance grows increasingly urgent. This Note argues that the public deserves both information security and constitutional protection, which can be secured only if courts--and, namely, the Supreme Court--afford Fifth Amendment protection to compelled biometric decryption.

Following the Introduction, Part I provides an overview of Fifth Amendment jurisprudence. This includes the three required elements to invoke one's Fifth Amendment privilege (compelled, incriminating, and, most importantly, testimonial); (15) two key Supreme Court precedents--act of production doctrine (testimonial) (Fisher v. United States) (16) and physical-trait evidence (nontestimonial) (Schmerber v. California) (17); a highly influential analogy (United States v. Hubbell) (18) that compares compelled decryption to either producing a "combination to a safe" (testimonial) or a "key to a [lock]" (nontestimonial); (19) and the gaps in Supreme Court precedent that currently leave lower courts struggling to apply outdated legal tools to novel constitutional issues.

Part II illustrates how the legal issue of compelled biometric decryption lies at the intersection of Fisher's act of production doctrine (testimonial) and Schmerber's physical-trait evidence precedent (nontestimonial). While lower courts generally hold compelled production of an alphanumeric password to be testimonial, (20) lower courts are split on compelled biometric passwords, differing in how they apply Schmerber (21) Some courts hold that compelled biometric decryption is nontestimonial, characterizing the biometric identifier as Schmerber's physical-trait evidence and likening it to Hubbell's lock-and-key analogy. (22) Other courts maintain that a biometric identifier, in the context of compelled decryption, is testimonial and distinguishable from both Schmerber and Hubbell (23) This Note argues that courts--both lower courts and the Supreme Court--should employ the latter reasoning in deciding cases of compelled biometric decryption.

Given the lag in Supreme Court precedent, the mounting tension between constitutional rights and consumer technology, and jurisdictional splits forming along legal interpretations of biometric identifiers, it is reasonable to believe a case involving compelled biometric decryption could make its way to the Supreme Court in the near future. Part III therefore presents legal, public policy, and originalist constitutional theory arguments for why the Court should uphold the testimonial nature of compelled biometric decryption. From a legal standpoint, this Note argues three points: first, in the context of decryption, a biometric identifier is distinguishable from physical-trait evidence because it is not the actual evidence law enforcement seeks but rather provides access to the evidence; second, Hubbell's lock-and-key analogy is an inapposite comparison to a biometric identifier regarding its functionality and stronger connections to individual identification; and third, the act of producing a biometric identifier not only contains implicit communications, but it communicates even more than the act of producing an alphanumeric password. (24) From a public policy perspective, this Note argues three points: first, the law should not force the public to bargain away constitutional rights for enhanced information security provided by biometric passwords; second, an individual's constitutional protections should not hinge on decryption format (i.e., whether unlocking a device uses a passcode or fingerprint); and third, affirming the testimonial nature of biometric decryption restores, or at least mitigates, the disrupted "equilibrium of government power" caused by this "seismic shift[] in ... technology." (25)

Finally, Part III also addresses the fact that if--or, rather, when--a case of compelled biometric decryption makes its way to the Supreme Court, the current makeup of the Court indicates originalism will likely drive the legal analysis. (26) This section of the Note provides an overview of originalism, the "enshrined principle" of the Fifth Amendment (nemo tenetur prodere seipsum, or "no one is obliged to accuse himself' (27)), and how enshrined principles are designed to capture evolving social norms. As such, the Court should reevaluate the testimonial nature of a fingerprint in the context of twenty-first-century technology and afford Fifth Amendment protection to compelled biometric decryption. (28) Ultimately, the Supreme Court should find that actions speak louder than words, and compelled biometric decryption is a testimonial act.

1. Fifth Amendment Jurisprudence

   The Fifth Amendment of the United States Constitution provides that "[n]o person ... shall be compelled in any criminal case to be a witness against himself." (29) While the Fifth Amendment often conjures imagery of a courtroom drama where a witness testifies on the stand during a criminal trial, a person may invoke Fifth Amendment protection in other circumstances, such as while testifying during an investigatory proceeding (e.g., a grand jury hearing), when taken in for police questioning, and even during a deposition. (30) The Amendment's privilege against self-incrimination extends not only to "answers that would in themselves support a conviction" but also covers information that would "furnish a link in the chain of evidence" necessary to prosecute an individual for a crime. (31) Essentially, the mere possibility of criminal prosecution triggers the circumstances necessary to invoke the privileges and protections of the Fifth Amendment. (32)

   1. Invoking the Fifth Amendment

      After the necessary circumstances are triggered, three conditions must be satisfied for an individual to successfully assert the Fifth Amendment's privilege against self-incrimination: the individual must demonstrate that the information sought by the government is (1) compelled, (2) incriminating, and (3) testimonial. (33) First, the person must face legal compulsion to cooperate with the government. (34) Second, the compelled testimony must be incriminating, meaning that providing the requested information "could lead to the discovery of inculpatory evidence." (35) Third, the compelled conduct must be testimonial, meaning it forces a person "to disclose the contents of his own mind," thereby communicating a "factual assertion" or "convey[ing] any information to the Government." (36) While actions could be both compelled and incriminating, if the action does not assert facts, convey information, or disclose inner thoughts, the actions are...