A new report of U.S. Federal law enforcement officers forcing a suspect to unlock their iPhone with Face ID has been uncovered by Forbes, the first known case where this has happened with Apple’s new facial recognition technology. According to the report, the incident happened on August 10 as part of a child abuse investigation, when FBI agents searched the house of 28-year-old Grant Michalski of Columbus, Ohio. As part of the execution of a lawful search warrant, an FBI investigator told Michalski to put his face in front of the phone, and once Michalski duly complied, the agent proceeded to search through the suspect’s online chats, photos and other data deemed relevant to the investigation.
Michalski was later charged with receiving and possessing child pornography, and according to the affidavit for the search warrant for his iPhone X, FBI Special Agent David Knight noted that the device contained “various items of interest,” including conversations discussing abuse of minors over Kik Messenger, along with similar emails between Michalski and another defendant who is facing similar charges. Forbes notes that while Knight was able to manually search the device, due to restrictions in iOS he was still unable to get any data from the iPhone X using forensic technologies, since the device’s passcode is still required to connect the device with a computer in order to backup or extract data. Knight took photographs of the data that he was able to manually access, but admitted he didn’t get all of the information he wanted as he didn’t keep the iPhone open long enough, although in the court filing, Knight noted that he learned that both the Columbus Police Department and the Ohio Bureau of Investigation had access to “technological devices that are capable of obtaining forensic extractions from locked iPhones without the passcode” — most likely a reference to Cellebrite and Grayshift boxes, although recent development in iOS 12 have likely neutered these tools. According to Michalski’s lawyer, Steven Nolder, the FBI was unsuccessful at using Cellebrite tools to extract data from the device, and as a result have “not found any contraband on the cellphone.” However, Nolder described this as a “Pyrrhic victory” since he acknowledged contraband was found on other devices, but that there is no basis for him to challenge the use of the warrant to compel the Face ID unlock, as his “client was not harmed by its use.”
While the legal and rights issues surrounding compelling a suspect to unlock their iPhone with Face ID remain a grey area that is raising some concerns with civil rights advocates, at least some lawyers suggest that it’s probably within the bounds of current laws.
“Traditionally, using a person’s face as evidence or to obtain evidence would be considered lawful,” according to Jerome Greco, staff attorney at the Legal Aid Society, although Greco adds that “never before have we had so many people’s own faces be the key to unlock so much of their private information.” However, while law enforcement agencies are using more boilerplate language in warrants to allow them to access iPhones via biometric means, legal experts suggest that it’s almost certain challenges will be coming under the Fifth Amendment, which protects individuals from self-incrimination. Previous rulings have applied the Fifth Amendment as permitting suspects to refuse to hand over passcodes on this basis, however the body — fingerprints and facial features — aren’t considered a piece of knowledge, and these rulings therefore wouldn’t apply to this kind of biometric information, even though the result is ultimately the same. Fred Jennings, a senior associate at Tor Ekeland Law, notes that “The law is not well formed to provide the intuitive protections people think about when they’re using a Face ID unlock. People aren’t typically thinking [when they use Face ID] that it’s a physical act so I don’t have this right against self-incrimination.” Jennings also adds that Face ID actually complicates the matter further, since the knowledge of which finger will unlock an iPhone is still “an item of knowledge being produced by the individual” that’s not unlike a password in that sense, while the argument is more difficult with Face ID, since it not only doesn’t require the user to divulge any information, but may not even require the user’s full cooperation.