FACES AND FINGERS: AUTHENTICATION.

• Author: Reitinger, Nathan

1. Introduction

   Imagine you have the desire to protect digital information stored on a mobile device. Would you feel comfortable using a mobile device with an unlock feature automatically triggered by an infrared scan of your face? Stated concretely, if you own an iPhone with FaceID, should you anticipate being compelled to look at your phone, thus permitting access to those unsavory Google search queries (1) or poorly thought-through selfies? (2) Indeed, the only mechanism standing between the law and your secrets is your phone's "lock" screen--instantly, automatically, and, once set up, unstoppably "unlocked" with a simple glance.

   At face value, the answer to this question turns on the Fifth Amendment's ability to protect physical features. Historically, this has played out through a game of analogy: is the compulsion more like surrendering a physical key or a mental key? (3) If the key involves no state-of-mind component (i.e., a physical feature), then the compulsion is likely non-testimonial and does not violate the Fifth Amendment. (4) However, if the key does involve some quantum of mental state, then the compulsion is likely testimonial, protected by the Fifth Amendment. (5)

   In this vein, courts consider passwords to be testimonial, meaning it is unlawful to compel the production of a special phrase, but fingerprints non-testimonial, making it lawful to compel the placement of a finger on a mobile device. (6) Although this conclusion is not consistent across the board, a trend is identifiable. (7) And in terms of a face, which easily places itself in the physical camp, the game of analogy would likely return a non-testimonial, just-tell-me-where-to-look answer. (8)

   Missing from the debate, however, is a technical understanding of the "why" behind device unlock. What are the properties driving the mechanics of device unlock, and why are those properties necessary for the mechanism to be considered "good enough" for public use? The simple answer here is authentication--the means of identifying and verifying users. (9)

   Following a brief legal overview of compelled device unlock, this short Essay unpacks the technical underpinnings of authentication in the context of FaceID. FaceID is Apple's newest unlock mechanism which, in simple terms, uses a face as a key. (10) This understanding is then applied to the constitutional inquiry, concluding that the primitives of authentication necessarily impart a substance in and of itself. Authentication, in this sense, is a form of truth telling--an expression of exclusivity, ownership, and control. Compelling the use of a finger or face to unlock a phone should not be deemed different than compelling the recitation of a password. Whether finger, face, or phrase, all are a form of truth telling, and thus should be deemed protected under the Fifth Amendment.

2. Testimonial Communication: Truth Telling

   "No person... shall be compelled in any criminal case to be a witness against himself." (11) Although three independent inquiries spring from this one constitutional sentence, (12) the jurisprudential fireworks have mostly been reserved for the last, a testimonial communication. Further, the Supreme Court has graced us with a fair share of its own communication in discussing the acts that constitute the meaning of "testimonial."

   In one of the first cases to draw a hard line, Holt v. United States, (13) the Court found the act of putting on a blouse to see if it would fit the defendant to be non-testimonial. (14) The Court disagreed with defendant's argument that the action was unconstitutionally compelled, or, as the defendant argued, an "extravagant extension of the Fifth Amendment." (15) In support of its decision, the Court stated that prohibiting compulsion to extract communications from a defendant is distinct from the use of a defendant's body as evidence. (16) If the use of a defendant's body as evidence was prohibited, then it would in essence "forbid a jury to look at a prisoner and compare his features with a photograph." (17) From there, the rest was easy: providing a blood sample, (18) voice or hand-writing exemplar, (19) or required presence in a police line-up (20) were all deemed nontestimonial.

   The identifiable theme, beyond physicality, was that neutral actions (i.e., those having no bent toward substance in and of themselves) are not protected by the Fifth Amendment. As stated in Hubbell v. United States, (21) although the contents of a document may be privileged, the "'act of production' may implicitly communicate statements of fact." (22) This is to say, physical features merely exist, and requiring them to be plainly displayed--regardless of the feature's identifying (23) characteristics--does not give rise to constitutionally protected substance or facts.

   More recently, however, less-clear cases have attempted to blur this line. One of the most interesting, In re Grand Jury Subpoena to Sebastian Boucher, decided in 2007 ('Boucher I") and revised in 2009 (("'Boucher IF), (24) involved access to a computer containing illegal content. Although the computer had been consensually accessed by a security guard unveiling illicit material, on later inspection, encrypted files put a hard-stop to the investigation. (25) Law enforcement could not practically or theoretically (26) view these files without a passcode, which the defendant did not want to divulge. (27) Although the district court seemed to find favor with the defendant's Fifth Amendment argument, it eventually pivoted, finding that although the files were protected by the Fifth Amendment, the computer had already been inspected, and therefore the "foregone conclusion" applied. (28)

   The foregone conclusion has its roots in Fisher v. United States, (29) where an accountant attempted to have documents withheld that were already known in existence and location to the government. (30) The Court ruled in favor with the government, finding that the documents were not being compelled for "truth telling" purposes. Rather, the government already "knew" of the documents' existence and merely needed the metaphorical lock to be released. (31) Likewise, the government in Boucher II had enough knowledge of the illegal material's existence (i.e., these files had already been seen) to bypass the Fifth Amendment's privilege and compel production of the courtdeemed mental state (i.e., the password).

   Exemplifying the above concerns culminates in Justice Stevens's dissent in Doe v. United States (32) Here, the majority found that compelling a defendant to sign a consent decree releasing banking records was not testimonial because it was not an implicit or explicit factual assertion disclosing incriminating information. (33) It is notable that the Court focused heavily on the language of the consenting instrument. "[T]he form does not acknowledge that an account [exists] or that it is controlled by petitioner. Nor does the form indicate whether documents or any other information relating to petitioner are present at the foreign bank... . The form does not even identify the relevant bank." (34) Again, this comes from the through-line in Fisher--truth telling. The majority argued that the release form permitting disclosure was not used for its "truth telling" effect. In other words, the form was viewed as more of a logistical lock to the substance rather than the substance in and of itself. But it is on this point--a point further exemplified by the properties of authentication (35)--that Justice Stevens disagreed.

   Justice Stevens noted how the defendant's forced signature on the release was necessarily tied to a statement of fact. "The [consent decree] itself may not betray any knowledge petitioner may have about the circumstances of the offenses being investigated by the grand jury, but it nevertheless purports to evidence a reasoned decision by Doe to authorize action by others." (36) Although implied ownership is a somewhat tenuous form of authorization, and not enough for the majority to disallow the compulsion, it is enough--according to Justice Stevens--to warrant a pause. This gave rise to Justice Stevens noting how a defendant may be "forced to surrender a key to a strongbox containing incriminating documents, but [may not be] compelled to reveal the combination to his wall safe--by word or deed." (37)

   Indeed, Justice Stevens's statement has become the cornerstone of a growing body of case law viewing the testimonial-non-testimonial distinction as hinging on a physical-mental distinction. (38) We can see this in United States v. Kirschner, (39) where a defendant was permitted to withhold his computer password from the government because it imbued his state of mind. (40) Further, this is also seen in Commonwealth v. Baust, (41) where the court found a passcode protected by the law (i.e., a content of the mind), but a fingerprint unprotected by the law (i.e. a mere physical attribute). (42) The trend continued in State v. Diamond, (43) where the court held that compelling a defendant to use a finger to unlock a phone "is no more testimonial than furnishing a blood sample, providing handwriting or voice exemplars, standing in a lineup, or wearing particular clothing." (44)

   Additionally, the physical-non-physical distinction is currently the favored approach by law enforcement. For example, in a district court in California, pursuant to a warrant, a defendant was required to "place his face in front of an iPhone X" that was found in his possession during the course of an execution of a warrant. (45) Similarly, a memorandum with a genesis of the Central District of California argued that using a fingerprint to unlock a device is simply and solely a physical endeavor--something entirely beyond the fingers of the Fifth Amendment. (46)

   Rejecting this trend, however, and understanding the nuance of Justice Steven's statement, is In re Single-Family Home & Attached Garage. (47) In this case, the court looked...