In January, the United States Court of Appeals for the District of Columbia Circuit ruled in U.S. v. Brown that the FBI violated the Fifth Amendment privilege against self-incrimination when it compelled a man to unlock his phone with his thumbprint. The decision created a circuit split on the question of whether the compelled unlocking of a device using the suspected owner’s biometrics violates the Fifth Amendment. The Supreme Court may consider resolving the split in a future case, setting a national standard for compelled unlocking of devices secured with physical identifiers. This would have significant implications for digital privacy because law enforcement has long argued that its inability to open locked devices justifies its arsenal of backdoor access tools.
If the Supreme Court chooses to resolve the split, its decision could also have significant implications for searches of electronic devices at the border. Customs and Border Protection (CBP) officials have broad authority to inspect travelers’ devices without a warrant. To coerce travelers to consent to a search of their device, CBP officials can temporarily detain mobile devices or deny admission to non-citizens, but they cannot force travelers to provide their passcodes. The recent surge of viewpoint-based immigration enforcement actions, including at airports and other ports of entry, elevates concerns that certain individuals targeted for their political beliefs might be coerced to unlock their devices to subject them to search.
Is the compelled use of your thumbprint to unlock your phone “testimonial?”
Application of the Fifth Amendment protection against self-incrimination turns on whether the conduct law enforcement compels is “testimonial.” The Fifth Amendment provides that “[n]o person shall be […] compelled in any criminal case to be a witness against himself.” This protection extends to statements and physical acts that are “testimonial,” [1] which means “explicitly or implicitly, relate a factual assertion or disclose information.”[2]
The D.C. Circuit applied this test to the compelled use of biometrics to unlock a device in a set of consolidated cases involving three co-defendants implicated in the attack on the U.S. Capitol on January 6, 2021.[3] During the investigation, FBI agents obtained the cell phone of one of the co-defendants, Peter Schwartz. Schwartz failed to provide the correct numeric passcode to unlock the phone, so the FBI compelled him to unlock it with his thumbprint, which revealed incriminating text messages. Schwartz was convicted at trial and appealed, arguing the compelled unlocking was testimonial, and therefore unconstitutional, meaning evidence derived from it should have been excluded.
It is well-established that the compelled disclosure of a passcode is testimonial [4], but the Supreme Court has not addressed the question whether the same is true of compelled use of fingerprints or other biometrics to unlock devices. In April, the Ninth Circuit ruled in U.S. v. Payne that it was not. The Ninth Circuit reasoned that such compelled acts were not explicit communications and required no cognitive exertion, such that under two related lines of Supreme Court precedent — the physical trait cases and the act of production doctrine — the compelled use of fingerprints to unlock phones should be considered like blood draws or routine fingerprinting, which are non-testimonial and not protected. No other circuit has addressed this question.
In U.S. v. Brown, the D.C. Circuit took the opposite view, concluding that the compelled use of Schwartz’s thumbprint was testimonial under both the physical trait cases and the act of production doctrine. First, under the physical trait cases, the D.C. Circuit reasoned that the compelled use of fingerprints communicates knowledge about ownership and means of access, which is not like blood draws or routine fingerprinting, and is “much closer to responding to a lie detector test.” Second, under the act of production doctrine, the D.C. Circuit reasoned that Schwartz’s response to the command to unlock his phone disclosed information about his control over his phone and his knowledge about how to access it, which was “tantamount to answering a series of questions about ownership or control […], including how [the phone] could be opened and by whom.” Therefore, the D.C. Circuit ruled that the compelled use of Schwartz’s thumbprint was testimonial and violated the protection against self-incrimination under the Fifth Amendment. As a result, the D.C. Circuit reversed the district court and remanded the case for further consideration.
In theory, the reasoning behind this ruling should also apply to other forms of biometric security, like Apple’s Face ID. But the D.C. Circuit emphasized its reliance on the facts of this particular case, meaning whether the compelled use of biometrics is unconstitutional might vary on a case-by-case basis.
Can your thumbprint be “spoofed” to circumvent constitutional questions and unlock your phone?
While we wait for the Supreme Court to resolve the circuit split, one might wonder: Could law enforcement avoid constitutional uncertainty by using your thumbprint obtained during routine booking or another non-testimonial act to spoof your thumbprint and unlock your device?
In short, it’s complicated.
There is no definitive consensus on the extent to which fingerprints can be spoofed to bypass biometric security, but reports generally indicate that most successful spoofing methods are intricate, time-consuming, and model- or operating system-specific. In 2020, Cisco Talos Intelligence Group reported that it successfully accessed common consumer phones with spoofed fingerprints around 80% of the time. But the report acknowledged significant differences in success rates across devices due to different sensors and operating systems, which are frequently updated to address vulnerabilities. The Cisco Talos report further recognized that some devices in the study were never unlocked, even when the sample fingerprints were molded directly from the registered finger or obtained in a manner that replicated fingerprints taken by border control agents at the airport.
***
The D.C. Circuit decision marks a significant moment in the protection of digital privacy and raises critical questions about the limits of accessing sensitive personal information on phones. Although this decision upholds individual digital privacy rights and the right against self-incrimination, it could also be used to justify law enforcement’s possession and use of tools to bypass biometric security and access devices without requiring input or consent from owners. The Supreme Court should resolve the circuit split in a future case to help clarify the rules for privacy and law enforcement access to personal devices, an increasingly common and important issue.
This article, “Circuit Court Split Lays the Groundwork for SCOTUS Case on Biometric Cell Phone Unlocking,” was written by Tom Bowman and published on June 4, 2025. The original article can be found here, on the Center for Democracy & Technology website.
Contact Granite Discovery to learn more about our services and how we can help you.
