Touch ID is more of a convenience than a security feature, and the FBI made that perfectly clear by obtaining a court order forcing a suspect to put their finger on the touch sensor and unlock their iPhone. The order shows courts still view our finger prints as physical evidence even when they serve as biometric keys to unlock devices and decrypt data.
Warrant let FBI use suspect's finger to unlock iPhone
Paytsar Bkhchadzhyan was arrested in late February, and only 45 minutes later FBI agents had a warrant in hand compelling her to place her finger on her iPhone's Touch ID sensor to unlock the device. Considering how quickly the warrant was obtained, the FBI probably assumed before the arrest and seizing the iPhone that Ms. Bkhchadzhyan's fingerprint would be the best way to gain access to her encrypted data.
U.S. courts have long held that our fingerprints are evidence and can be collected without a warrant. Compelling someone to provide their fingerprint as a means to unlock something, however, is more controversial, although in this case FBI agents didn't have any issues obtaining the order.
The argument supporting fingerprint unlock orders says they're akin to physical keys, which suspects can be compelled to provide through a warrant. Handing over a key isn't self incriminating, according to the courts, and as such providing a fingerprint to unlock a smartphone would fall under the same umbrella.
The other side of the argument is that when our fingerprints are used as biometric tools to unlock something they should be treated as if they're passcodes we've memorized but haven't written down. Courts can't compel someone to give up their device passcode because that would qualify as self incrimination. In the case of Touch ID, the implication is that any device your fingerprint unlocks is under your control, and a court forcing you to do so would go against the Fifth Amendment's delf incrimination protections.
University of Dayton law professor Susan Brenner told the Los Angeles Times, "By showing you opened the phone, you showed that you have control over it. It's the same as if she went home and pulled out paper documents — she's produced it."
Stanford Law School Center for Internet and Society director of privacy Albert Gidari disagrees and sees biometric unlock tools differently. He said, "Unlike disclosing passcodes, you are not compelled to speak or say what's 'in your mind' to law enforcement. 'Put your finger here' is not testimonial or self-incriminating."
Next up: The FBI doesn't like being in the dark