It’s Official: Your Smartphone is Part of Your Brain

by in Security

In a decade, we’ve gone from asking “What’s a smartphone?” to cultural dependence on them. Not only do we clutch them constantly as we tweet and FB and text and IM each other (and, once in a while, actually talk); not only are they often our primary authentication method; but new technology and services increasingly require smartphone apps for use.

Its Official Your Smartphone is Part of Your Brain.jpgIn 2014, the U.S. Supreme Court ruled, in Riley v. California, that seizing the contents of a cellphone without a warrant was unconstitutional. While important, this was perhaps less significant than the Indiana state Court of Appeals’ August Seo v. Indiana decision that even with a warrant, forcing someone to unlock their phone constitutes “testimony” and thus can be refused under the Fifth Amendment to the U.S. Constitution.

In other words, the court acknowledged that these wee devices constitute extensions of our brains, and since you cannot be forced to testify against yourself, you therefore cannot be forced to unlock your phone.

Seo was a stalking case. As is often true in these rights-of-the-accused cases—from Gideon v. Wainright (“You have the right to an attorney; if you cannot afford one, one will be provided for you at no cost to you…”) to Miranda v. Arizona (the origin of rest of the “You have the right to remain silent…” speech), the major facts did not seem to be in dispute. That does not make the accused guilty, of course: as ever, it is up to police and court to convince a jury of that, and the prosecution wanted any evidence they could get from Seo’s phone.

The police arrested Seo and got a warrant to search her phone. She refused to provide the password, and was held in contempt of court. On appeal, the majority wrote:

A modern smartphone, with its central purpose of connecting its owner to the Internet and its ability to store and share incredible amounts of information in ‘the Cloud’ of online storage, is truly as close as modern technology allows us to come to a device that contains all of its owner’s conscious thoughts, and many of his or her unconscious thoughts, as well. So, when the State seeks to compel a person to unlock a smartphone so that it may search the phone without limitations, the privacy implications are enormous and, arguably, unique.

It was also important that the phone was encrypted, and locked with a numeric passcode instead of a fingerprint. Fingerprints are “something you are”, rather than “something you know”. Case law has established that you cannot refuse fingerprint access, but can refuse to tell someone a password. Because the phone was encrypted, the court considered that the data did not exist while the phone was locked:

We consider Seo’s act of unlocking, and therefore decrypting the contents of her phone, to be testimonial not simply because the passcode is akin to the combination to a wall safe as discussed in Doe [v. United States]. We also consider it testimonial because her act of unlocking, and thereby decrypting, her phone effectively recreates the files sought by the State.

This idea that data in some sense does not exist while encrypted is particularly interesting, as logical extensions to it make one wonder if stolen data that has been encrypted no longer constitutes possession of stolen property: was there therefore no crime? Of course, the instant someone were to decrypt that data, they would be breaking the law. But what if they claim they lost the encryption key?

Another aspect of the case was that the prosecution was unable to specifically identify what they wanted from Seo’s phone:

…the State must be able to describe with reasonable particularity the discrete contents on Seo’s phone – e.g., all texts to D.S. created on Seo’s iPhone – that it is compelling her to not only produce, but to re-create by entering her passcode and decrypting the contents of the phone. This is a burden the State has not met.

Although as the title of this post suggests, the wording of Seo v. Indiana seems to suggest that cellphones are brain extensions, that’s clearly not really what courts believe: if they did, then getting anything from a cell phone, even with a warrant, would be impossible. But this decision is still important as a partial acknowledgment of how closely our phones are tied to our privacy. So stay tuned! And consider disabling fingerprint (and facial recognition) unlock if you are concerned about the privacy of your phone contents.


Data security and encryption