Smartphone Passcodes Get Official Legal Protection

The passcodes used by smartphone owners to access their devices have been given significant legal protection in the US.

A court in Pennsylvania ruled that the codes are protected by the Fifth Amendment, which defends against self-incrimination, meaning that law enforcement agencies can no longer demand suspects hand over the passwords to their devices.

However, the ruling did not extend to fingerprint access, which was deemed to be similar to having your prints taken at a police station.

Insiders

The ruling came from federal court Judge Mark Kearney in the case of Securities and Exchange Commission (SEC) v Huang, an insider-trading lawsuit brought against Bonan Huang and Nan Huang, two former employees of Capital One.

The Register reported that the pair were accused of running an insider-trading scam whilst employed at the bank which ultimately netted $2.8m of investments from just a $150,000 initial stake, reportedly thanks to using Capital One’s internal records to make stock market bets on as many as 170 companies.

The two former analysts were given with smartphones by Capital One, but the company let them pick the passcodes themselves to maintain security.

When the two were fired in January 2015 they handed back the mobiles, which the SEC now wants to access to check for evidence – however the Pennsylvania court ruled that forcing the pair to unlock the passcode-protected devices would violate their constitutional rights as laid out by the Fifth Amendment.

Personal

“We find, as the SEC is not seeking business records but defendants’ personal thought processes, defendants may properly invoke their Fifth Amendment right,” Judge Kearney wrote in his analysis.

“Absent waiver of the confidentiality attendant to this personal thought process, we cannot find the personal passcodes to the Bank’s smartphones to be corporate records falling under the collective entity cases. We find Defendants’ confidential passcodes are personal in nature and Defendants may properly invoke the Fifth Amendment privilege to avoid production of the passcodes.”

Kearney also noted that the SEC hadn’t actually proven that the smartphones in question held documents pursuant to the case, and that since the SEC cannot prove that incriminating documents are on the handsets, the agency can’t force defendants to hand over their codes.

What do you know about Internet security? Find out with our quiz!