Since the courts decided you have to use your fingerprint to unlock your phone (because they decided that's not giving up your password and they can't compel you to give up your password), what if you use your fingerprint to wipe your phone? But you don't tell anyone ahead of time when they force you to use it. I'm sure you'd be arrested at the least.
I can't be the only person who has thought of this.
A password is considered (by courts) to be testimony. Face, gesture or fingerprints are considered things like keys which you can be forced/compelled to turn over when commanded by law enforcement. Therefore, only passwords, which will require a court order to unlock, are secure enough for now.
> A password is considered (by courts) to be testimony
For now. It doesn't seem like an especially natural fit. Regardless of the merits of being able to compelled to turn over your password, relying on labored interpretation of laws is not a good idea: 14th amendment was always a very shaky basis for abortion rights, as the 2nd is a very shaky one for personal gun rights.
At that point, just don't have biometrics configured at all. It would be waaay to easy to accidentally wipe your phone. Just have an unlock PIN and a duress PIN. You're going to be charged with destroying evidence either way if you use the duress method, so you may as well use the method that won't accidentally wipe your phone with a single misplaced finger.
Yes. But I apparently didn't make the point I wanted to. If you set your phone to delete everything when you scan your fingerprint, is that a crime? No password need be provided. You cannot avoid giving them your fingerprint to unlock a phone, already established in the US as a legal rule.
I'm sure they will claim its a crime if you set it up that way, but is it?
They can already legally compel you to provide your fingerprint. You can't avoid that, you'll get put in jail. Do you have to tell them "don't do that with my phone, it will reset everything if you do that".
IANAL, but I would bet that's still destruction of evidence. Judges are human, for better or worse, and can see the intention behind cute tricks like this.
It might work if your fingerprint was used while you were unconscious, but any solution that starts with "setup a trigger that wipes a device" is already on shaky grounds.
> "setup a trigger that wipes a device" is already on shaky grounds
It isn't on shaky grounds: you protect your private device from everyone, not just from some "law enforcement". If you want to protect your private device from any party (e.g. thieves, trivially), it will also be protected against law enforcement agents as a side effect.
What trigger would you setup to protect against thieves? I can't think of any that has the right sensitivity (not triggering if I start running to catch the bus), and won't escalate the violence (like my fingerprint wiping the phone in front of an armed robber).
And remember that the context here is you explaining your digital booby trap to a judge who thinks you might have deliberately destroyed evidence.
> What trigger would you setup to protect against thieves?
"Wipe the data after a number of failed logon attempts".
I understand that this does not fit completely with the "in front of law enforcement" idea, but it opposes your «any solution that starts with "setup a trigger that wipes a device" [would be] already on shaky grounds»: we can very legitimately setup triggers that wipe devices in the possibility that the device falls into random hands.
AFAIK it's legal to set up a trigger that wipes a device. It isn't legal to choose to wipe your device after you know the government wants the data. Tricking the government into wiping it is still allowed, especially if you tell them not to do that.
That matches my understanding too. Unfortunately it sounds like the poster was suggesting to wipe the device after the government requests access, and was probably not planning on telling the officers about the trigger.
The theoretical scenario was the government seized your device, they don't give it back to you. You decline to give them they password. You don't say anything else, you have the right to remain silent. You aren't not telling the government to do anything. You don't suggest they scan your fingerprint. They are in charge, you are cooperating with lawful orders ("provide your fingerprint").
There are videos on youtube where the lawyers tell you what your rights are at traffic stops, also there are ones that talk about the different rules when coming through immigration. These can be painful to see when they show the ones where cops ignore limits.
So at the border, they tell you that you are legally required to provide your finger print, you do that, and don't say a word. I'm sure it will be a bad day for you, regardless of how it works out after years of litigation on whether it is your duty to tell them how NOT to unlock your device.
With fingerprint unlock it's not your choice. That's what makes it clever. The cop can grab your finger and hold it to the scanner while you tell him not to do that.
Presumably you must disclose that "doing that" would wipe the device... and you better hope this is caught on some neutral party's camera so there is a record of you saying that.
I am not a lawyer, I am just "making up" what exculpatory evidence I would prefer to have on my side when potentially confronted with a charge of destruction of evidence after pulling a stunt like this.
isn't this what that guy did and he got in trouble for it?
I'm talking about the one when asked for the pin gave the pin that would wipe the data from his graphene os phone
No he gave the duress PIN while implying it was the correct PIN. That was the crime. Also they only caught him because he bragged that it was the duress PIN after the wipe.
Yes, the difference is you do exactly what they say, you follow legal orders to give your fingerprint, or also it could be "take a picture of you to unlock". I'm sure eventually the govt will make a new rule and a judge will say "you have to tell us in detail if we give you legal orders and it won't do what we think" or something like that.
That happened because he chose to give the duress PIN. Cops are allowed to just grab your finger and scan it against your protest. You can say "don't do that, it'll wipe my phone" and they'll do it anyway and it'll wipe your phone, and now it certainly isn't your fault.
What does it matter? The state certainly isn't going to throw up its hands and say "you got us". They're still going to try to make it out to be your fault and even if you do successfully argue it wasn't of your volition, they've still robbed you of years of your life and hundreds of thousands of dollars in lawyer fees.
My plan is to live a reasonable life and treat the state like I treat violent weather. If I happen to have the misfortune of drawing the attention of the state, then yes, your suggestion may be relevant.
> they've still robbed you of years of your life and hundreds of thousands of dollars in lawyer fees.
Intentionally giving a duress PIN which you know will wipe evidence - information you were just asked for by some law enforcement - just robs you of more of years and money. The law is lopsided and gives some more power than others. There's no point debating why it's like that, try to change the law before you break it or find ways to not need to break it at all.
One simple trick that's proven to work is to just leave biometrics disabled and refrain from giving your password.
There are all sorts of situations where people go free despite the wistful desires of prosecutors, due to the details of what happened and what the law actually says.
> Tech people like to imagine law is code, but it’s not. Nor should it be.
Of course it should be code. More specifically, it should be completely deterministic.
This idea that judges/courts can interpret the law however they feel like it in each individual case is what gives power to dictatorships. Then there is no way to know what is legal vs not, each scenario is different and the courts will inevitably choose what favors them. So yes, ideally, law should absolutely be "code" (deterministic).
This may be true for hackers but courts have to prove guilty beyond a reasonable doubt to the letter of the law.
The law here is destruction of evidence. The guy destroyed evidence by giving the wrong password to the police. If the police had destroyed it of their own accord, he'd be free. If the duress PIN was 1234 and the police just tried it, he'd be free.
Best approach is to shadow-ban the user when they do a secret gesture before logging in. No wiping necessary. Easiest implementation is to just log them into a shadow account.
Since you seem to know about this, what are the actual rules about "destruction of evidence" in your jurisdiction? What does the accused need to have known for a crime to have been committed?
(Common sense tells me that the accusation might make sense both in cases in which the accused knows about a crime and in cases in which the accused knows about a police investigation, even in the absence of a crime, but deleting nude photographs to stop a customs officer from seeing them, for a random example, would that be a crime?)
Generally any material you intentionally delete after you are told to hand over evidence is considered to be the most incriminating version of that material in a court of law.
That rule wouldn't work very well if the person who destroyed the evidence isn't the person suspected of the crime and it is unclear whether the person who destroyed the evidence is a friend or an enemy of the suspect. So I think a sane legal system would want to punish the person who destroyed the evidence rather than jeopardise the fair trial of the suspect.
Imagine dozing off in the interrogation room, and the not-so-sharp officer seizes the moment and decides to use your thumb to unlock the phone, with the camera recording.
"You dumbass! You use my thumb to trigger duress mode! Don't you know thumb is always wipe, and PIN is always unlock? Moron!"
They don't need to reason that evidence was destroyed. They just need to reason they there was an attempt to destroy potential evidence, whether or not there was actually any evidence. Any kind of interference with an investigation in any way is likely subject to prosecution.
Write your duress PIN on the back of the phone. I guarantee you the first cop that sees it will go, "LOLOL!!!! HIS PASSWORD IS RIGHT THERE!!! LOLOL" and immediately enter it.
I heard for this reason police are now trained not to try any code that you can't go to jail for if it turns out to be a duress code. That means anything you didn't tell them was the unlock code.
I can't be the only person who has thought of this.