The Newest Password Technology Is Making Your Phone Easier for Police to Search

In August, 28-year-old Grant Michalski was implicated as part of a ring of men sharing images and videos of a young girl, the daughter of one of the ring’s members, being sexually abused. The FBI arrived at Michalski’s home with the authority to require him to unlock his iPhone X using the phone’s Face ID feature. It was the first search warrant of its kind.

The implications are huge. From schools to summer camps to baseball stadiums to, of course, phones, biometric technology is everywhere. It’s how we sort photos, buy beer at baseball games, and board flights. Apple also recently filed patents for technology involving “secure access to an electronic device using continuous facial biometrics”—in other words, technology that could continually scan as it’s being used, locking itself again when held by someone it fails to recognize. IBM, Microsoft, and Intel have all filed patents for some form of continuous authentication. Meanwhile, a small but growing micro-industry of behavioral biometrics start-ups purport to be able to use unconscious behaviors—the way users scroll and tap on their devices, the angle at which they hold their phones—to verify identity. Theoretically, you could gain access to someone’s devices by stealing their PIN, but the phone would notice a discrepancy in these unconscious behaviors and lock again. Banks are especially interested in using this technology to detect fraud.

When Michalski’s phone was seized, agents were limited in what they could access. Even after it was unlocked, the FBI agent would need the phone’s passcode in order to plug it into a computer for forensic analysis to find“hidden, erased, compressed, password-protected, or encrypted files.” Interestingly, the law treats passcodes and PINs differently from fingerprints and face scans, even if they perform the same function: unlocking devices.

According to John Verdi, Vice President of Policy at the Future of Privacy Forum, compelling passcodes from suspects can be extraordinarily difficult because of the Fifth Amendment, which enshrines our right not to be forced to incriminate ourselves. High courts have ruled consistently that passcodes are “testimonial”—that is, that they “explicitly or implicitly, relate a factual assertion or disclose information”—and therefore that forcing citizens to surrender them is self-incriminating and unconstitutional.

But biometrics are different. Despite being more advanced technology, they’re encoded into the law as a traditional search. “In the same way that giving someone a breathalyzer test or giving someone a blood test to try to determine the presence of alcohol is not testimonial in a Fifth Amendment sense,” Verdi told me, biometrics are “rather a search under the Fourth Amendment.” Police can acquire these types of warrants more easily.

This creates an interesting inversion. If your passcode is say, your mother’s birthday or your wedding date, a thief or snooping spouse could correctly guess and have full access to your device and everything therein. Biometrics, particularly the emergent wave of continuous biometric authentication, are almost certainly  a stronger security option—unless law enforcement is involved.

But of course, most average users aren’t using their phones with the expectation that someday the FBI will come knocking. Dr. Brian Jackson, a scientist at the RAND Corporation studying criminal justice and homeland security, told me that consumer preferences for novelty and convenience are shifting how people compute what he refers to as “risk calculus”—how we weigh the tradeoff between privacy and convenience as we acquire more intelligent devices. “As technology changes and as people get used to things, things that we at one point we would have thought were very invasive or very different become routine.” Jackson said.

A good example, he said, is the Smart TV: an always-on listening device that continuously hears for external commands before communicating with other devices. It’s literally a microphone in your home. That may have caused alarm five years ago, but now, Jackson said, “I was talking to folks and they’re like, ‘It’s actually getting tougher to find TVs that don’t have that built in.’ That’s a feature that people have liked and it’s convenient and it’s cool and therefore, the market proliferates it. It would not surprise me if, as biometrics get more instituted to more and more devices for various convenience-related things that it’ll seem much less unusual for these sorts of things to crop up.”

As the market adapts to this new convenience, Jackson said, people will, perhaps unwittingly, shift away from passcodes, invisibly changing the stakes of our risk calculus. Continuous authentication, like face recognition before, is a massive scaling-up of processing power, and a showcase for the potency of artificial intelligence. If only our privacy and legal protections could scale up at a similar pace.