The Face ID ruling is a big win for digital rights. Here’s what needs to happen next.

Now, if the cops try to force you to unlock your iPhone with your face, the law might actually be on your side. 

Previously, other courts have ruled that the police could make suspects unlock their phones with Touch ID, even though legally they couldn’t force that same suspect to give up their passcode. Digital rights experts hope that a ruling in California, however, is a step toward changing that precedent.

Recently, California magistrate Judge Kanis Westmore denied a request for a warrant to compel suspects to unlock their phones using Face ID and Touch ID. In a written opinion (via Apple Insider) from Jan. 10, she said she made her decision in part because forcing someone to give up a passcode — whether alphanumeric or biometric — would violate their Fifth Amendment right against self-incrimination. 

“As most iPhone users know, we use our thumb- and face-prints for the same purpose we manually enter a code: to unlock our phones,” said Brett Max Kaufman, a staff attorney with the ACLU Center for Democracy. “Today’s ruling makes that clear in the court of law, and helps ensure we don’t lose our constitutional rights simply because we’ve started using Touch or Face ID thanks to a recent phone upgrade.”

In an issue that has pulled judges in multiple directions in related cases, this recent decision is encouraging news for privacy advocates. But there’s still a long way to go before this legal opinion — that a biometric passcode is the equivalent of verbal self-incrimination — is enshrined as binding law.

“This definitely marks progress, at least in terms of how judges are thinking about these cases,” said David O’Brien, a senior researcher at Harvard University’s Berkman Klein Center for Internet & Society. “But I am expecting that we’re not going to have the issue resolved until the Supreme Court picks it up.”

In an extortion and blackmail case in Oakland, investigators sought a search warrant for the suspects’ home. Included in the warrant was a request to both collect any smart phones that they might find, and to compel the phones’ owners to unlock their devices through Face ID and Touch ID. 

In part, this case is significant because it is the first case where Face ID in particular was considered in the judge’s written decision, O’Brien said. But it could have larger implications, too. 

Searching the phones of two individuals suspected of blackmail sounds reasonable, right? Where else would they keep said blackmail?

But the judge denied the request for two reasons. 

First, because it was “overbroad,” and therefore ran afoul of the Fourth Amendment right against unreasonable search and seizure. 

And second, because of the right, included in the Fifth Amendment, of a person to not have to provide testimony against themself. The key idea here is that a passcode is a form of “testimony.” But this decision is where things get legally tricky. 

“The Fifth Amendment side is the more interesting and difficult side,” Judge Smith said. “What’s difficult about this issue is testimonial vs. non-testimonial distinction. Courts have had trouble drawing on this, and have gone different ways.”

Smith explained that previous rulings have defined self-incrimination as anything “testimonial,” or anything that takes mental effort. Under that definition, the law prevents law enforcement from compelling someone to give up a passcode. But because a fingerprint, or face or iris scan does not require cognition or speech, it’s fair game for a warrant. Judge Smith described it as the difference between giving up a lock vs. a passcode for a safe.

If this smells like BS to you, you’re not alone. What’s the purpose of distinguishing between a verbal and biometric code if they both yield the same result? It’s loophole that privacy advocates aren’t happy about. 

If this smells like BS to you, you’re not alone

Digital rights organization the Electronic Frontier Foundation (EFF) strongly advocates that the law treat biometric data as a potential form of self-incrimination. 

“As Magistrate Judge Westmore correctly recognized, given the sheer amount of data on modern day cell phones, the government simply cannot anticipate the full contents of someone’s phone, and any order compelling someone to unlock their phone — whether via a numeric passcode or a fingerprint scan— violates the Fifth Amendment privilege against self-incrimination,” Jamie Williams, an EFF Staff Attorney, wrote in a statement to Mashable.

Privacy advocates like the EFF and the ACLU agree that the courts should treat biometric data used to unlock phones and passcodes as one and the same. However, the courts and legal scholars aren’t all on the same page. A DC Magistrate Judge issued an opinion on a similar matter in June, and came to the opposite conclusion of Judge Westmore. 

Despite the fact that higher courts have not reached an agreement on how to apply Fourth and Fifth Amendment rights to biometric passcodes, Smith — a former magistrate judge who considered similar warrants himself — said that including these sorts of biometric requests in warrant applications has become routine. So, naturally, the warrant requests result in inconsistent decisions.

What actually makes this case significant is the fact that Westmore decided to issue the opinion at all.

“I’m encouraged by these types of decisions by magistrate judges,” Smith said. “They are flagging new law enforcement techniques, that generate these legal questions that need to be resolved, so the law can catch up with technology.” 

Judicial decisions often carry weight beyond their particular case because of the idea of precedent: that what one court has ruled becomes the guiding judgment on similar matters.

However, the idea of legal precedent is more complicated than it might seem. 

At the federal level, the only way to achieve true binding precedent — meaning that an issue of interpreting the law has been decided — is for the Supreme Court to issue a ruling on a matter. Binding precedent can also be achieved at a district level once a court of appeals rules on the matter.

Because Westmore is a magistrate judge — not a judge on a court of appeals — what she created was persuasive precedent. No judge faced with a similar warrant is required to follow her reasoning, but may look to it for guidance. 

“There’s no guarantee about consistency across different circuits,” O’Brien said. “But now that there is at least one opinion that reasons through it in this particular way, it’s possible we could see other courts come out in the same way.” 

That actually is progress in deciding this matter, because more often, judges deny or grant warrants without entering their reasoning into the public record. Judge Westmore’s decision to write an opinion raises the profile of biometric passcode warrant applications as an issue that higher courts could consider.

Additionally, the Supreme Court likes to take controversial cases — issues that result in differing judicial opinions. With biometric data already ginning up opinions on both side of the Fifth Amendment issue, there’s a higher likelihood that it could catch the Supreme Court Justices’ attention.

“Hopefully, the more of these decisions come out, the courts will crystallize these issues, and they’ll go up on appeal, and eventually the Supreme Court will decide and give guidance to the lower courts,” Smith said. “These issues are coming up every day.”

Digital rights advocates are clear that courts should treat biometric passcodes just as they do alphanumeric ones. And they similarly applaud judges like Westmore for calling attention to the matter in their decisions.

“It’s important that courts are looking closely at how searches of digital devices affect our constitutional rights,” the ACLU’s Williams said. “The Supreme Court has made clear that digital searches raise serious privacy concerns that did not exist in the age of physical searches.”

It’s not clear how higher courts will rule. In the meantime, if you’re worried about law enforcement getting access to your phone, skip the face and finger sensor and just choose a passcode. A good one.