Can Law Enforcement Force You To Unlock Your Cell Phone And Disclose Your Passcodes In Criminal Investigations?

In this blog Dallas criminal defense lawyer for Digital Privacy Defense John Helms explains:

• Search Warrants for Cell Phone Contents
• The Fifth Amendment and Testimony
• Biometric Data
• Passcodes and the Foregone-Conclusion Doctrine
• Law Enforcement Access Without Passcodes and Biometric Data
• Conclusion

Introduction

The Law around modern cell phones can be confusing luckily Dallas criminal defense lawyer John Helms is here to explain.

Modern cell phones can contain a tremendous amount of data.  In criminal investigations, some of the most powerful evidence against the accused is often stored on their cell phone.  Law enforcement officers know that suspects routinely have highly incriminating messages with other conspirators on their cell phone.  They may even have photos or videos of themselves with drugs or guns.  If a criminal prosecution depends on proof of the accused’s intent or knowledge, cell phones may offer a huge window into the accused’s mind.

Modern cell phones also come with increasingly sophisticated privacy protection.  For example, most cell phones encrypt the data within the phone and do not allow access to the phone unless the user enters a passcode.  Many require both a biometric identification, like a fingerprint or facial recognition, in addition to a passcode, in order to allow full access in certain situations.

If law enforcement wants to examine your cell phone for evidence against you, they may need either biometric identification, a passcode, or both, in order to access what is on your phone.  But can they force you to open the phone or disclose your passcode?  The answer is extremely complicated.

First of all, unless you are at or near the border or at an airport coming to or from a foreign country, law enforcement cannot legally seize and search your phone or demand a passcode just by commanding you to do it.  Without a search warrant, this would violate the Fourth Amendment’s prohibition on unreasonable searches and seizures. See Riley v. California, 573 U.S. 373, 382 (2014).  So, other than in the border situation, you do not have to comply just because a law enforcement officer tells you to do something.  

Search Warrants for Cell Phone Contents

Let’s say, however, that law enforcement has a search warrant for your cell phone.  Does a search warrant allow them to force you to open the phone and provide a passcode?  Here, the answer becomes complicated.

A search warrant means that a judge has concluded, based on a sworn statement from law enforcement, that there is probable cause to believe that a specific search will uncover evidence of a crime or contraband and that the requested search would be reasonable.  A search warrant is designed to satisfy the Fourth Amendment’s prohibition against unreasonable searches and seizures.  So, if there is not a Fourth Amendment issue, can a police officer with a search warrant force you to open your phone or give up your passcodes?  Not so fast.

Even if the Fourth Amendment is not an issue, the Fifth Amendment will be.  The Fifth Amendment protects against self-incrimination.  It states that no person “shall be compelled in any criminal case to be a witness against himself.”  U.S. Const., Am. 5.  

The Fifth Amendment has been interpreted to mean that a person cannot be forced to provide “testimony” against himself, whether in a criminal investigation, or in court.  When a person refuses to answer a question that might incriminate them, we often hear this called “taking the Fifth.”  But how does this apply to opening cell phones?

The Supreme Court recognized long ago that forcing someone to produce their personal papers to the government involves a “testimonial” component.  See Fisher v. United States, 425 U.S. 391, 406-408 (1976).  At a minimum, producing your papers implicitly communicates that the papers exist, that they are in your possession, and that they are genuine.  In a criminal case, this information can be used against a person to help prove a crime.  In other words, the things that producing your papers communicates can be incriminating.  Compelling a person to communicate something that incriminates them is exactly what the Fifth Amendment says the government cannot do.

Biometric Data

To see how this applies to opening cell phones, let’s first look at biometrics.  Touching your finger to a sensor to scan your fingerprint or allowing a phone to be held up to your face for facial recognition, arguably does not communicate anything.  Therefore, most courts have held that forcing someone to allow their biometrics to be used to open a phone is not testimonial and does not violate the Fifth Amendment.  A few courts, however, have held that the use of biometric data is testimonial and cannot be compelled because of the Fifth Amendment.  In most places, however, there is probably not binding case law one way or the other.

So, what should you do if law enforcement has a search warrant and insists that you provide biometric data?  My advice is to contact a criminal defense lawyer as soon as you possibly can.  If you refuse to comply, the officers may arrest you and, ultimately, ask a judge to order you to comply.  Your lawyer might be able to convince a judge to follow the minority of cases holding that the Fifth Amendment applies.  Your lawyer also might be able to argue successfully that the search warrant does not specifically authorize the officers to force you to press your finger on the sensor or allow the device to be held up to your face.  Either way, though, you might spend some time in jail before a judge can hear the matter and rule on it.

Passcodes

This might be surprising, but passcodes are a completely different issue.  Just about every court that has considered the issue has ruled that providing passcodes is “testimonial,” because it requires communicating a thought that is in your mind.  See, e.g., In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335, 1341 (11th Cir. 2012); In re Search of [Redacted], 317 F. Supp. 3d at 534-36; United States v. Djibo, 151 F. Supp. 3d 297, 307 (E.D.N.Y. 2015). This means that forcing someone to provide a passcode implicates the Fifth Amendment.  

Does this mean that you can never be forced to provide passcodes?  No!  That would be too easy!  There is a principle called the “foregone-conclusion doctrine” that, in most jurisdictions, allows forced disclosure of passcodes when the facts support it.  But what is the foregone-conclusion doctrine, and when does it apply?

Remember that the reason disclosing passcodes is considered testimonial is because the fact that a person knows the passcode communicates that the person has access to the private cell phone and can use it.  That can be important in a criminal case because it can help the government to prove that the accused was using the phone and knew about what is on it.  It can likely prevent a defendant from claiming it was someone else’s phone, and the defendant never used it and did not know what was on it.

Almost all courts that have considered the issue have held, however, that if requiring a person to reveal the passcode discloses nothing other than what the government already could prove about the person’s connection to the phone, then there is not a Fifth Amendment violation.  In other words, if it was a “foregone conclusion” that the government could prove the person’s connection to the phone, apart from the person’s knowledge of the passcode, then there is not a constitutional problem with requiring disclosure of the passcode. 

The courts that have considered the issue, however, disagree on the level of proof required to show that the foregone-conclusion doctrine applies.  Some courts say that passcode disclosure can be compelled if the government can show that a passcode exists, and the suspect knows the passcode.  Other courts, including the only two federal appeals courts to have considered the issue, have held that the government must prove that it knows of the existence, possession, and authenticity of the files on the cell phone.  I am not aware of any federal cases from Texas or the Fifth Circuit, which covers Texas, that have addressed the issue.

All of this is to say that the law of compelled decryption is a mess.  See O. Kerr, The Law of Compelled Decryption Is A Mess: A Dialogue, Reason, August 10, 2020 (available at https://reason.com/volokh/2020/08/10/the-law-of-compelled-decryption-is-a-mess-a-dialogue/).

Because the law is a mess, my advice is to decline, politely, to provide passcodes if law enforcement tries to persuade or force you to provide them, until you can talk to an experienced criminal defense lawyer with expertise in this complicated area of the law.  You are very unlikely to be arrested for doing so, because almost everyone agrees that the Fifth Amendment applies to the disclosure of passcodes, and whether you can ultimately be compelled by a court to provide passcodes involves all kinds of legal complexity.

Can Law Enforcement Access Cell Phone Contents Without Passcodes and Biometric Data?

One final technical issue deserves discussion:  As a technical matter, can law enforcement get access to the contents of your cell phone, even if they do not have your passcodes or biometric data?  The answer is that they probably can, although the length of time and amount of effort it would take them is uncertain and changing.

Law enforcement (but not the public) can buy a device called GrayKey from a company in Austin, Texas, called GrayShift.  GrayKey uses a “brute force” method of finding passcodes to permit the extraction of cell phone data.  This means that it will proceed to try every combination of numbers or letters until it identifies the passcode.  If they have a search warrant, there is probably no Fourth Amendment issue, and since you will not be required to communicate anything, there is no Fifth Amendment issue, either.

How long it takes depends on the complexity of the passcode, who you ask, and the state of the art, which changes as the cell phone makers and GrayShift adjust to each other’s tactics.  

In 2018, an assistant professor and cryptographer at the Johns Hopkins Information Security Institute, estimated that GrayKey could unlock a standard  iPhone that uses a simple four-digit code in six and a half minutes, or 13 minutes at the longest.  He further estimated that a six-digit passcode takes up to 22.2 hours to break, while processing an 8-digit code can take as few as 46 hours or up to 92 days.  See “Researcher estimates GrayKey can unlock 6-digit iPhone passcode in 11 hours, here’s how to protect yourself,” Apple Insider, April 17, 2018 (available at https://appleinsider.com/articles/18/04/16/researcher-estimates-graykey-can-unlock-a-6-digit-iphone-passcode-in-11-hours-heres-how-to-protect-yourself).

According to a 2020 article:

The exact length of time varies, taking about two hours in the observations of our source. It can take up to three days or longer for six-digit passcodes, according to Grayshift documents, and the time needed for longer passphrases is not mentioned. Even disabled phones can be unlocked, according to Grayshift.

See, “FBI got data from a locked iPhone 11 using GrayKey: how does this tool work?,” Andrea Fortuna, Jan. 22, 2020 (available at https://andreafortuna.org/2020/01/22/fbi-got-data-from-a-locked-iphone-11-using-graykey-how-does-this-tool-work/#:~:text=The%20exact%20length%20of%20time,be%20unlocked%2C%20according%20to%20Grayshift.)

However, in a 2023 filing, the United States Attorney’s Office for the District of Columbia and the Justice Department’s Criminal Division made the following statement:

Where a phone passcode is a combination of four numbers, the software may take a few weeks to access the phone. Where a phone passcode is a combination of six numbers, the software may take up to one year to access the phone. Where the passcode is an alphanumeric combination, accessing the phone could take several years. In addition to trying every combination of a series of numbers, the software allows law enforcement to guess the passcode and try those combinations first.  

United States v. Brian Jeffrey Raymond, Criminal No. 1:21-cr-00380, Government’s Opposition to Defendant’s Motion to Suppress Evidence, at 25-26 (March 24, 2023).

These estimates vary significantly, and they seem to increase as time goes on.  Perhaps this is because Apple’s countermeasures have improved.  In any event, it appears that there is technology that allows law enforcement to open up a person’s cell phone without first knowing the passcodes.  In addition, law enforcement can subpoena data from Apple for information stored on iCloud.

The fact that law enforcement can probably access your device without your cooperation does not mean that they will not want you to give them access voluntarily.  In fact, in my experience, they want that very much.  Even with GrayKey, it can take a long time and a lot of effort to brute force into a phone, and each agency will have a limited number of GrayKey devices and a lot of other phones in line for processing.  Depending on the complexity and number of your passcodes, the agency may have difficulty opening your phone in time for your trial or the trial of any alleged coconspirators without your cooperation.  If you intend to contest your guilt and have a trial, you are probably better off contesting any attempt to force you to disclose your passcodes.  On the other hand, if you are likely to plead guilty and to cooperate with the government, your knowledge of your passcodes can be very valuable to the government.

Conclusion by Dallas criminal defense lawyer for Digital Privacy Defense John Helms

All of this is to say that you should not give away your passcodes before you talk to an experienced criminal defense lawyer who can help you understand all of the potential costs and benefits of voluntarily disclosing them.  The law in this area is wildly complicated and uncertain.  The facts of your case will be crucial, and disputes or uncertainty about the facts will only multiply the possible outcomes.  Do not try to figure all of this out on your own. 

Consult with a John Helms Dallas criminal defense lawyer with expertise in these issues who can help you decide what is best for you.