Recent Virginia Case Carries Major Implications for Fingerprint Passcodes and Self-Incrimination

This article was originally published in the Spring 2015 issue of the Virginia Bar Association YLC Docket Call.

The ever-evolving technological landscape constantly elicits new and interesting questions of law. Privacy and data security are areas of contention and confusion for many. Why?  Because privacy limits are unclear because the reach of technology outpacing the evolution of the law. As cell phones have advanced, they have become essential to everyday life and are no longer merely phone used to make and receive calls. Cell phones are minicomputers filled with personal, and mostly private, information including calendars, alarm clocks, books, videos and photos. People store everything from grocery lists to banking information in phones. How do the laws that govern phones solely to make and receive calls apply to these new multifaceted devices? Courts and lawmakers are slowly answering that question.

In Reily v. California, the Supreme Court shed some light on privacy limits regarding cell phones.[1] The Court held that the police generally may not, without a warrant, search digital information on a cellphone seized from an individual who has been arrested. The Court characterized cell phones as minicomputers filled with massive amounts of private information, which distinguished them from the traditional items that can be seized from an arrestee’s person, such as a wallet. This ruling is a necessary stride towards deciphering how the Fourth Amendment applies in this digital age but leaves a lot of unanswered questions.

After obtaining a warrant to search a phone how will officers access the contents? Can officers compel the accused to provide one’s passcode or fingerprint? Existing laws do not apply smoothly and presents an interesting question: Is producing one’s passcode or fingerprint to allow access to digital information on a smartphone testimonial communication subject to the Fifth Amendment privilege against self-incrimination?[2] This was the question answered in the Virginia case Commonwealth of Virginia v. Baust.[3]

In Commonwealth of Virginia v. Baust, the defendant David Baust was indicted on charges of assault.[4] The victim alleged that video of the assault was on Baust’s smartphone.[5] The police obtained and executed a search warrant, retrieving (among other items) the smart phone.[6] However, the phone was “locked” and could only be entered using a passcode or fingerprint.[7] The court decided to review each method of entry separately under the Fifth Amendment and arrived at two different conclusions.

The court held that fingerprints and passcodes are different in the eyes of law because of the testimonial nature of providing a passcode, which violates the accused’s right not to incriminate him or herself. The Judge explained that Baust could not be compelled to provide his passcode to access the smartphone, but could be compelled to produce his fingerprint to access the phone.[8] Producing the passcode would require the defendant to divulge knowledge—information from his own mind, placing it in the testimonial realm.[9] However, he concluded that a personal fingerprint does not require any similar knowledge—it is equivalent to a key that fits into a lock.[10]

This legal distinction will have a major impact on smartphone users, especially as providers market the increased security of these alternate access mechanisms. Your fingerprint is advertised as a more secure method for accessing tour phone but presents vulnerability if ever compelled to provide access to your phone. The legal differences may not be clear to users, as the passcode and the fingerprint are functionally equivalent. Should they really be distinguished under the law? Is there a distinction between telling police a passcode and typing in the passcode so that police may gain access to a phone? By typing the code, the individual does not have to provide any knowledge (testimony) directly to the police, although still providing access to data that is potentially criminally incriminating. Is the outcome or the means more important, because although not a verbal testimony providing a fingerprint or writing a passcode may lead to criminally incriminating information?

This decision raises a lot of questions and determining privacy rights in our technology will only get more complex as technology continues to evolve. The court is being charged to assess the functional and technological implications of new technology and create laws with those perspectives in mind. This is a difficult balance. Consistency will also be important to citizens as they seek to protect themselves within the bounds of these laws.

Most immediately, in Virginia, you should protect your phone using a passcode, not your fingerprint.

 

 

[1] 134 S. Ct. 2473, 2477 (2014).

[2] Commonwealth of Virginia v. Baust, No. CR14-1439, at 2 (Va. 2d Cir. Ct. Oct. 28, 2014).

[3] Id. at 1.

[4] Id.

[5] Id.

[6] Id.

[7] Id.

[8] Id. at 4.

[9] Id. at 5.

[10] Id.

A New Option For Fighting Anonymous Spammers

The federal Controlling the Assault of Non-Solicited Pornography and Marketing Act (“CAN-SPAM Act”) that went into effect on January 1, 2004 was intended to combat the onslaught of annoying, unsolicited emails sent by spammers, including sexually explicit email materials. This law is why we have seen legitimate businesses identifying their solicitation emails and providing an unsubscribe or opt-out option.  BUT the observable benefits don’t stop here anymore?   In a fortunate turn of events, this law is being used to combat those pesky privacy shields that allow spammers to hide behind private registrations.   

Background

Let me give a little background on privacy or proxy domain registrations. Domain privacy is a service offered by a number of domain name registrars. A user buys privacy from the company, who in turn replaces the user’s info in the WHOIS with the info of a forwarding service (for email and sometimes postal mail, done by a proxy server) such as “Domains by Proxy, Inc.” or eNom‘s “ID Protect”.  

 

It is often advertised as a means to protect users from spammers but has actually become a tool for spammers because it allows them to act behind of cloak of anonymity. Although, these registrars collect personal information the information is often not helpful.  Spammers either provide inaccurate information or these registrars are very protective of the information because of their intended purpose therefore, access to this information is often an insurmountable hurdle. 

 

The Emerging Standard

A recent ruling by the United States District Court for the District of Utah is the second of two decision pointing towards a nationwide shift in the interpretation of the CAN-SPAM Act. The Court ruled that where an unsolicited marketing email message contains a generic proxy registration name (where the registrant’s true identifying information is “cloaked”), such email violates the CAN-SPAM Act and subjects the sender to statutory penalties. In fact, the Court determined that proxy registrations may violate two provisions of the CAN-SPAM Act. The Court relied on a California State court ruling concerning a substantially similar set of facts as persuasive authority in reaching its decision.

no spam! (Photo credit: Wikipedia)

Utah based ISP, ZooBuh, got fed up after after receiving nearly 15,000 spam messages from marketing firm Better Broadcasting over an eight month period. Better Broadcasting ignored their complaints, so they filed a CAN-SPAM complaint against them in Zoobuh v. Better Broadcasting et al, and won.

 

The Court concluded that emails from a privacy-protected domain name such that the recipient cannot identify the sender from the “from” name or publicly available WHOIS information is a violation of 15 U.S.C. § 7704(a)(1)(C).  Additionally, this kind of cloak violate Section 7704(a)(1)(A) of the CAN-SPAM Act because “even header information that is technically accurate violates the CAN-SPAM Act when the email ‘includes an originating electronic mail address, domain name, or Internet Protocol address the access to which for purposes of initiating the message was obtained by means of false or fraudulent pretenses or representations.” The Court noted that, when a party registers a domain with an ICANN-compliant registrar, the domain registration agreement itself prohibits the use of the registered domain to send unsolicited commercial email. Therefore, if a marketer intends to use the domain for “prohibited purposes”, the marketer will have obtained the URL under false pretenses and any email that is eventually sent through the use of such URL will be in violation of the CAN-SPAM Act.

 

Under the CAN-SPAM Act, a successful plaintiff may recover monetary damages equal to the actual losses suffered or statutory damages of $100 per header violation, whichever is greater. In addition, a court may award triple damages where a marketer uses an automated process to create proxy registered email addresses.  As far as collecting damages, the best plaintiff for this kind of claim is continually and aggressively  being spammed. However, as more of these cases pop up it ill deter this kind of spam assault.  

 

Privacy Concerns

This does raise a privacy concern.  Although malicious actors and spammers should not be able to hide behind proxy registrations, we need to be careful not to let a proxy become an indicator of legality. We all have a right to privacy online.  Freedom of speech is an important consideration.  Should you need to complete identify yourself to express your opinion? 

 

Businesses Beware 

Businesses need to be mindful of CAN-SPAM requirements, because CAN-SPAM also applies to legitimate businesses that communicate or advertise via email. Because CAN-SPAM’s requirements can be easy to overlook in day-to-day activities, businesses should take the time periodically to ensure their compliance with the CAN-SPAM law, especially since violations of the law can result in both civil and criminal sanctions.

 

Highlights of the National CAN-SPAM Act Standards:

Businesses that send promotional email to existing or potential customers must understand the applicability, requirements, and prohibitions of CAN-SPAM. CAN-SPAM requires all unsolicited commercial email messages to be labeled, to include opt-out instructions and the sender’s postal address, and prohibits the use of deceptive subject lines and false headers.  Specifically: 

• Commercial email must be labeled as such and include opt-out information.
• Businesses/Senders are prohibited from continuing to send commercial email to recipients who have asked not to receive it after a 10-day grace period.
• False header information and deceptive subject lines are prohibited.
• Automated email address harvesting and automated spam attacks are restricted.
• Using other people’s computers or email accounts to send commercial email is prohibited.
• Enforcement powers to the FTC

So what do you think about this new tool to fight spammers?