November 3, 2014
A state court in Virginia recently issued a ruling with significant implications for the privacy of mobile devices. In Virginia Circuit Court, Judge Steven Frucci concluded that police could require a defendant to provide his fingerprint, enabling the authorities to access his smartphone. Judge Frucci also noted, however, that police could not require disclosure of an access code for the device without a warrant.
In the case at issue, the defendant was alleged to have assaulted his girlfriend. Police believed that video of the alleged assault was available. They also believed that the relevant video might be accessible on the defendant’s smartphone.
The defendant’s smartphone was secured through fingerprint access control. The police tried to compel the defendant to provide his fingerprint to enable access to the device’s content. The defendant refused to provide his fingerprint and his lawyer argued that the attempt to compel access to the fingerprint constituted a violation of the Fifth Amendment protection against self-incrimination.
Judge Frucci ruled that the police could require access to the defendant’s fingerprint. He noted that fingerprints are similar to DNA and handwriting samples in this context. Fingerprints are pieces of tangible evidence, and the law permits authorities to collect such evidence as part of investigations.
In contrast, Judge Frucci noted that pass codes are forms of knowledge. The Fifth Amendment protects defendants from compulsory disclosure of knowledge which might incriminate them. The Judge in this case thus distinguished between fingerprint access controls and traditional pass codes.
The ruling in this case suggests that pass codes offer more complete protection of privacy from searches by government authorities than do fingerprint access controls. Perhaps the most effective approach to privacy protection is use of both fingerprint and pass code access controls. In addition, use of encryption can help to preserve privacy even if access controls are defeated.
Although fingerprint access controls seem to provide greater security against most unauthorized parties, this case demonstrates that they may be far less secure against government access. In contrast, pass codes can be broken or stolen, but Judge Frucci’s ruling suggests that they qualify for Fifth Amendment protection.
This case underscores the value of using multiple forms of privacy protection when possible. No single form of protection is effective against all threats. In this environment, the most effective approach to privacy is use of more than one form of access control and content protection.