Endpoint

1/15/2019
01:51 PM
100%
0%

US Judge: Police Can't Force Biometric Authentication

Law enforcement cannot order individuals to unlock devices using facial or fingerprint scans, a California judge says.

American law enforcement cannot force people to unlock devices using a facial or fingerprint scan, as stated in a new ruling intended to protect individuals from intrusive federal searches.

US judges had previously given authorities power to force people to unlock devices using biometric scans, even though they couldn't force them to share passcodes. A new ruling, which says all passcodes are equal, has been called a "potentially landmark" verdict, Forbes reports.

It comes from the US District Court for the Northern District of California, where a search warrant for an Oakland property was rejected. As part of a Facebook extortion crime investigation, police wanted to access phones on the property with biometric scans. Magistrate judge Kandis Westmore ruled this was "overbroad" as it didn't specify a person or device.

Even with a warrant, the judge said, government officials could not force people to incriminate themselves by using facial, fingerprint, or iris scans to unlock mobile devices. Passcodes and biometric scans can all be used to log into devices and should be treated the same. If someone cannot be forced to provide a passcode, they also cannot be forced into biometric scans.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:57:34 PM
Re: Security vs privacy
@Stephen: What do you suggest?

Not being a jerk; I'm genuinely interested. Lots of competing interests here.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:56:37 PM
Re: Golden rule
@REISEN: Well put. We've already seen some examples of this insofar as using pictures of people to recreate images of their fingerprints/irises/etc.

As sometimes-contributor-to-Dark-Reading Terry Ray once put it (I paraphrase): Don't make your password public.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2019 | 6:53:59 PM
Re: Watch Out!
@Edward: It's not even necessarily gruesome in such examples. In Spaceballs, for instance, all the hero has to do is knock out the guy to use his handprint.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/5/2019 | 8:09:06 AM
Golden rule
Laws do so much and enforcement the same.  The safe and sane rule is to assume that whatever YOU put out there will BE hacked at some time in the future.  WE have control over what at least WE expose. Now there are data trails of life too - house sold, moved, and address databases by the score.  Employment history.  (I was surprised by the detail Georgia unemployment knew about me!!!)   But we can control SOME of it assume your history is OUT THERE and act accordingly.    Somebody somewhere knows everything about you. 
StephenGiderson
50%
50%
StephenGiderson,
User Rank: Apprentice
2/4/2019 | 8:42:08 PM
Security vs privacy
In my opinion, everyone should be entitled to their own rights. This isn't just about giving them the privacy, but also making sure that they get the security that they deserve. There should be an alternative measure as a solution instead of enforcing a law that forces individuals to authenticate whenever required.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Apprentice
2/1/2019 | 9:02:30 PM
Watch Out!
This is wrong on so many levels. But if you've watched as many movies as I have, if you can't crack the password to get into the data storage, it's as simple as torture. With biometrics, I'm sure you've seen what the bad guys do when they need someone's retina or fingerprint to get into the locked room right...
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/19/2019 | 8:16:35 PM
USDC opinion
What's being missed here is that this opinion (1) represents a split from other court opinions in the US on this issue, and (2) comes out of a lowly federal district court. Consequently, it has no binding value in and of itself. So it remains to be seen what the widespread law of the land in the US on this issue is.

(Disclaimer: The above is provided for informational, educational, and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication, or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/17/2019 | 12:33:37 PM
Re: Evidence?
Agree - a warrant should do the job.  No cooperation = jail time for failing to assist and hindering an investigation.  Plus bearing all costs of an unlock procedure with, say, Apple.  
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 12:48:49 PM
Evidence?
I guess my question is, if you can't force a potential perpetrator to unlock their phone via warrant, can this be facilitated through a formal court injunction? If you can't, would there be any value in utilizing a phone as evidence? You would have to crack the code yourself which can take time and I would think in a criminal case that data on a phone would be valuable to the verity of the case.
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9945
PUBLISHED: 2019-03-23
SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid user...
CVE-2019-9942
PUBLISHED: 2019-03-23
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
CVE-2018-20165
PUBLISHED: 2019-03-22
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
CVE-2019-1716
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability ...
CVE-2019-1763
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exist...