I figure this issue (which is really two different legal issues) may very well reach the Supreme Court during Judge Neil Gorsuch’s time on the court (assuming he’s confirmed), so I decided to do some digging on two issues:

1. Would Judge Neil Gorsuch Compel You to Enter or Disclose Your Passcode?
2. Would Judge Neil Gorsuch Compel You to Use Your Thumbprint/Fingerprint to Unlock Your Phone?

Case Law on Unlocking Smartphones

Here’s where we stand in various jurisdictions on whether or not you can be compelled to unlock your smartphone. Note that I, and the legal folks, use the words “passcode’ and “password” interchangeably.

“A Minnesota appellate court ruled Tuesday against a convicted burglar who was forced by a lower state court to depress his fingerprint on his seized phone, which unlocked it.” Court rules against man who was forced to fingerprint-unlock his phone | Ars Technica

This means the State of Minnesota Court of Appeals ruled in favor of compelled use of your fingerprint to unlock your phone.

“A Virginia judge ruled in 2014 that police can force users to unlock their smartphones with their fingerprints. But until this February, when a federal judge in Los Angeles signed a search warrant that required a woman to use her fingerprint to unlock her iPhone, it didn’t appear that any federal law-enforcement agency had ever used that power.,” Can Police Make You Use Your Fingerprint to Unlock Your Phone? – The Atlantic

So did the Virginia State Circuit Court. A federal judge in Los Angeles signed a search warrant requiring use of a fingerprint to unlock a phone, but that woman did not challenge the warrant, so the Los Angeles federal judge was not establishing case law.

“A ruling by the Florida Court of Appeals earlier this month, overturned a trial court ruling that a male suspect did not have to surrender the passcode to his phone after being accused of taking inappropriate pictures of an unsuspecting woman . The court said that would be tantamount to having the suspect testify against himself, which is protected by the Fifth Amendment.,” Florida court says password disclosure not protected by Fifth Amendment | ZDNet

The Florida Court of Appeals‘ ruling was more revolutionary: the Florida Court of Appeals ruled that the court can compel you to disclose your passcode.

“The United States District Court for the Eastern District of Michigan . . . In United States v. Kirschner, 823 F. Supp. 2d 665 (ED Mich 2010)(Opinion Attached As Exhibit “A”), the Hon. Paul Borman held that compelling the accused to disclose a password to an encrypted file would require “producing specific testimony asserting a fact” in violation of his Fifth Amendment right against self-incrimination.,” The Phone Passcodes: You Cannot Be Forced To Disclose It – Rockind Law

The United States District Court for the Eastern District of Michigan (a federal court) ruled in the more traditional fashion: the court can’t compel you to disclose your password because doing so would violate your fifth amendment right against testifying against yourself.

To be clear, because many of the above rulings are at the state level, most Americans remain unaffected by any of these rulings. For instance, if for some reason I was pulled over while driving in my neighborhood in Silicon Valley and law enforcement wanted to unlock my phone and I refused to provide my passcode, none of the above cases would be what’s called “controlling” (translation: the judge wouldn’t have to pay any attention to any of the above cases) when the judge decided whether or not I had to provide my passcode. Of course, there is other controlling case law that’s relevant (United States v. Hubbell), but nothing directly on point the way the above cases are.

Nice Summaries:

Ars Technica:

“The crux of the legal theory here is that a compelled fingerprint isn’t testimonial, it’s simply a compelled production—like being forced to hand over a key to a safe.

Had the defendant been forced to disclose his passcode (instead of depressing his fingerprint) to his phone, the constitutional analysis likely would have been different.

“Instead, the task that Diamond was compelled to perform—to provide his fingerprint—is no more testimonial than furnishing a blood sample, providing handwriting or voice exemplars, standing in a lineup, or wearing particular clothing,” the appellate court found.,” Court rules against man who was forced to fingerprint-unlock his phone | Ars Technica

Wired wrote on the issue back when it was still a hypothetical:

“If the police demand that you give them the key to a lockbox that happens to contain incriminating evidence, turning over the key wouldn’t be testimonial if it’s just a physical act that doesn’t reveal anything you know.,” Apple’s Fingerprint ID May Mean You Can’t ‘Take the Fifth’ | WIRED

Translation:

1. Providing your password requires you to think and remember your password which triggers the court to consider the Fifth Amendment and consider whether you are testifying against yourself.

More Details on the Fifth Amendment

Whether or not your fifth amendment right not to testify against yourself is triggered when the following three elements are met:

“(1) compulsion, (2) a testimonial communication or act, and (3) incrimination,” The Fifth Amendment, Encryption, and the Forgotten State Interest – UCLA Law Review. The author continues by explaining:

“With encryption and passwords, courts’ analyses gravitate to the key-combination dichotomy.35 Take the Eleventh Circuit’s recent decision in In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011.36 That court addressed the question of whether the Fifth Amendment bars the compelled decryption and production of the now-unencrypted data. It held affirmatively and explicitly framed the issue within this dichotomy, finding compelled decryption “most certainly more akin to requiring the production of a combination.”37,” The Fifth Amendment, Encryption, and the Forgotten State Interest – UCLA Law Review

The author concluded that “passwords are not like combinations: Only passwords make their contents effectively impenetrable to law enforcement,” The Fifth Amendment, Encryption, and the Forgotten State Interest – UCLA Law Review.

I disagree with the author: I think passwords are contents of your mind, the disclosure of which incriminates you, so the fifth amendment is triggered and protects you from disclosing your password. But I try to present the other side, so I included the above quotes from the UCLA Law Review.

2. Providing your finger/thumbprint triggers the court to consider the Fourth Amendment, and whether a valid search/seizure took place (was your reasonable expectation of privacy violated?).

More Details on the Fourth Amendment:

Whether or not you have a reasonable expectation of privacy is based on a two part test:

“The test concludes that the Fourth Amendment recognizes a government intrusion as a search when it intrudes into an area in which a person has (1) a subjective expectation of privacy, and (2) society is prepared to accept that expectation of privacy as reasonable,” Lauren Harriman, Protecting Your Texting: Gaps in Fourth Amendment Protection for Modern Communication, 19 Intell. Prop. L. Bull. 79 (2014) discussing Katz v. United States, 389 U.S. 347 (1967). (Yes, I’m citing to my own writing, but only because my law school article spends a fair amount of space explaining REP).

With regards to fingerprints, Findlaw explains:

“The Supreme Court has said that individuals do not possess an expectation of privacy in their personal characteristics (see United States v. Dionisio, 410 U.S. 1 [1973]). Thus, the police may require individuals to give handwriting and voice exemplars, as well as hair, blood, DNA, and fingerprint samples, without complying with the Fourth Amendment’s requirements.,” When the Fourth Amendment Applies – FindLaw

What does this all mean? It means that the Supreme Court has previously established that you don’t have a reasonable expectation of privacy in your finger/thumbprint, and that means that law enforcement asking you to unlock your phone with your finger/thumbprint doesn’t trigger fourth amendment protections. More on this below in my answer to #2.

Okay, so now you understand the legal issues to look for in Judge Gorsuch’s history:

1. Whether Judge Neil Gorsuch would require you to testify against yourself to unlock your phone.
2. Whether Judge Neil Gorsuch would require warrantless disclosure of your personal charactersistics.

Full disclosure: I do not know the answers going into this research, and I’d be super surprised if there was anything in Judge Gorsuch’s history indicating that he would compel you to testify against yourself to provide your passcode.

1. Would Judge Neil Gorsuch Compel You to Enter or Disclose Your Passcode?

Law in Play:

Fifth Amendment which protects you from testifying against yourself.

Judge Gorsuch’s comments during his confirmation hearing:

Unfortunately, nothing so far (I will update this if that changes).

Translation of Judge Gorsuch’s Relevant 10th Circuit Opinion:

This is actually pretty complicated, but I’ll do my best to break it down. So, Judge Gorsuch did write one opinion sort of on point: Feinberg v. Commissioner of Internal Revenue. In this opinion, there is convoluted law and convoluted facts, but the underlying message seems to be: if an appeal could successfully exclude any self-incriminating evidence obtained via the IRS, then the defendant shouldn’t be able to invoke the fifth amendment to prevent disclosure of the evidence pre-emptively. I don’t think it’s a huge stretch to see Judge Gorsuch finding that law enforcement should be able to compel you to disclose decrypted versions of the files on your phone, which would be a way around the issue of compelled disclosure of your password itself.

But I do want to reiterate: the opinion Judge Gorsuch wrote is talking about people who sought a writ of mandamus in response to an order from the tax court that they disclose documents which would have implicated that they were engaged in a marijuana business. So, the standards of law are super different. And it’s entirely possible that the facts and applicable procedural law in that case versus the hypothetical facts and hypothetical applicable procedural law which show up before Judge Gorsuch during his time on the Supreme Court could be different enough that Judge Gorsuch finds that passwords are testimonial. But honestly, we really just don’t know.

Conclusion:

We really just don’t know whether Judge Gorsuch would compel you to disclose your password or allow you to invoke your fifth amendment right against self-incrimination in order to refuse disclosure. Yes, I was surprised to learn the there was a chance Judge Gorsuch wouldn’t protect your right not to disclose your password.

2. Would Judge Neil Gorsuch Compel You to Use Your Thumbprint/Fingerprint to Unlock Your Phone?

Law in Play:

Fourth Amendment which protects you from unlawful search/seizure.

Judge Gorsuch’s comments during his confirmation hearing:

“Judge Gorsuch said that the court correctly looked back at old common law and found that attaching something to someone else’s property was considered a “trespass” under common law and therefore attaching a GPS monitor to a car constituted a search by the government.

“The technology changes but the principles don’t,” said Judge Gorsuch.” Supreme Court Nominee Neil Gorsuch Testifies: Live Analysis

Translation:

Judge Gorsuch’s views mirror Justice Scalia’s, which on the surface is okay, but when you dig a bit deeper, become a bit problematic. Why? Because even though Judge Gorsuch agrees on the surface that GPS monitoring without a warrant violates your Fourth Amendment rights, Judge Gorsuch’s reasoning is not based on his believing that you have a subjective expectation of privacy in your location and that your subjective expectation of privacy in your location is one which society is prepared to accept as reasonable. Nope. Judge Gorsuch’s reasoning is that warrantless GPS tracking necessarily requires physical trespass of a vehicle and that warrantless physical trespass violates your Fourth Amendment rights (U.S. v. Jones).

So as nice as it is that Judge Gorsuch said that “technology changes but the principles don’t,” the “principle” that you don’t have a reasonable expectation of privacy in your physical characteristics winds up with the result that you don’t have a reasonable expectation of privacy in the tool that you use to lock your phone (if you lock your phone with a finger/thumbrint).

Conclusion:

Judge Gorsuch’s following Justice Scalia’s reasoning regarding GPS tracking leads me to believe that Judge Gorsuch would follow Supreme Court caselaw which allows law enforcement to compel you to provide your fingerprint to ultimately find that you likely can be compelled to use your finger/thumbprint to unlock your phone.