A federal court has ruled that authorities cannot force people to give up their phone's password because doing so would violate the Fifth Amendment.
In other words, users' phones and passcodes are protected by the U.S. Constitution, and the Fifth Amendment allows individuals to refuse unlocking their device when requested by authorities.
The ruling that protecting all smartphone passwords falls under the Fifth Amendment comes from Judge Mark Kearney of the Federal District Court in Eastern Pennsylvania. The ruling [pdf] is related to an insider trading case between the U.S. Securities and Exchange Commission (SEC) and two former employees of Capital One.
Bonan Huang and Nan Huang, the two ex-employees in question, faced charges of illegal insider trading during their time with the credit card company. The two men allegedly took advantage of insider information they gained through their positions as data analysts to make stock market bets on 170 companies. The two men reportedly turned a $150,000 investment into a hefty $2.8 million with this scheme.
The duo had smartphones issued by their employer and, when the bank fired them, they were forced to return the devices. The SEC, as expected, requested access to the passcode-protected phones so that it could look for evidence of the ex-employees' alleged crimes.
The SEC argued that the phones were not personal devices, since they were issued and owned by the employer, so it should get access to the devices even if the two men chose the passwords themselves.
U.S. law generally allows the practice of forcing individuals to hand over evidence, be it even self-incriminating, as long as the existence of that evidence is confirmed. If, on the other hand, there's no specific knowledge that the evidence truly exists, the government cannot force people to hand over evidence that could incriminate them.
In this case between the SEC and two former Capital One employees, the SEC wanted access to those devices so it could fish for evidence, as it had no clear knowledge that the evidence actually exists on the devices.
Judge Kearney ruled that the SEC did not prove the evidence existed, therefore it cannot gain access to the two men's password-protected devices.
Moreover, the fact that the bank provided the devices but asked employees to set up their own passwords without writing them down means the employees' devices are protected by the Fifth Amendment, even if they are owned by the company.
Consequently, if the SEC can't prove that those devices certainly contain evidence and incriminating documents, it cannot gain access to them.
