Hacker News new | ask | show | jobs
by garrettgrimsley 3778 days ago
In the USA the courts treat passwords as testimony, and in most cases you can invoke your 5th amendment right and refuse to provide passwords or encryption keys, given the state does not already know the contents of the device. This same protection does not extend to physical keys, which I think fingerprints would fall under.

http://www.uclalawreview.org/the-fifth-amendment-encryption-...
3 comments
avs733 3778 days ago
That seems to be representative of the only actual ruling on this topic that I can find

>The Fifth Amendment to the U.S. Constitution gives people the right to avoid self-incrimination. That includes divulging secret passwords, Judge Steven C. Frucci ruled. But providing fingerprints and other biometric information is considered outside the protection of the Fifth Amendment, the judge said.

[1] http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-c...

link
spdustin 3778 days ago
It would seem to me that the "fingerprint = key" analogy is flawed. Physical keys can be trivially copied, and even reverse engineered from the locking mechanism. A key is a physical object that is required to disengage a lock.

A fingerprint, when used on an electronic lock of this kind, is not a key. It's attributable to one person only, not trivially duplicated, and not able to be reverse engineered from a locking mechanism. It requires an action by a single person who cannot be forcibly relieved of their possession of their fingerprint.

Additionally, a key is specified during the manufacturing or assembly of a lock, and comes with the lock, since they are "paired" when the lock is made. However, a fingerprint or password are specified by the user at will after they've assumed ownership of the device. They "testified" their identity to their phone with a fingerprint, just like they did with their password.

If compelled to imprint a finger, it is the same sort of personal interaction that a password entails: the credential holder utters/presents their personal information - not a physical object, but a repeated testimony of the same content they previously and uniquely presented to their device. It should be protected as other self-incriminating testimony under the fifth amendment.

link
Spooky23 3778 days ago
I think the courts have this one right. Your finger is a characteristic of you, not compelled speech.

If you can compel a suspect to stand up on a lineup, or produce id, there's no reason why the court shouldn't be able to compel you to produce a finger.

In technical terms, the finger is really a "something you have" second authentication factor. If you think of it on those terms, it's more like looking at someone's Hardware token than compelling a password disclosure.

link
Lawtonfogle 3777 days ago
>Your finger is a characteristic of you, not compelled speech.

So is all your knowledge. The technology to extract it doesn't yet exist, but once it does, should it be deployed by the courts without a challenge from the 5th Amendment?

link
Spooky23 3777 days ago
Clearly there's going to have to be some evolution from a legal standpoint once accessing your thoughts is a mere fMRI away.
link
rdtsc 3778 days ago
> If compelled to imprint a finger, it is the same sort of personal interaction that a password entails:

Not quite sure it is though. If they already arrested them, they already have the fingerprint don't they? That is different than key and is different than password.

link
stephentmcm 3778 days ago
Interesting being Australian I don't have a 5th amendment to protect me. Also my understanding is that at least in Australia you'd likely be charged with obstruction of some sort, does that not fly in the US?
link