Cops Are Now Opening iPhones With Dead People's Fingerprints (forbes.com) 212
An anonymous reader shares a report: In November 2016, around seven hours after Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife and been shot dead by a police officer on the grounds of Ohio State University, an FBI agent applied the bloodied body's index finger to the iPhone found on the deceased. The cops hoped it would help them access the Apple device to learn more about the assailant's motives and Artan himself.
This is according to FBI forensics specialist Bob Moledor, who detailed for Forbes the first known case of police using a deceased person's fingerprints in an attempt to get past the protections of Apple's Touch ID technology. Unfortunately for the FBI, Artan's lifeless fingerprint didn't unlock the device. In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said. He sent the device to a forensics lab which managed to retrieve information from the iPhone, the FBI phone expert and a Columbus officer who worked the case confirmed. That data helped the authorities determine that Artan's failed attempt to murder innocents may have been a result of ISIS-inspired radicalization.
Where Moledor's attempt failed, others have succeeded. Separate sources close to local and federal police investigations in New York and Ohio, who asked to remain anonymous as they weren't authorized to speak on record, said it was now relatively common for fingerprints of the deceased to be depressed on the scanner of Apple iPhones, devices which have been wrapped up in increasingly powerful encryption over recent years. For instance, the technique has been used in overdose cases, said one source. In such instances, the victim's phone could contain information leading directly to the dealer.
This is according to FBI forensics specialist Bob Moledor, who detailed for Forbes the first known case of police using a deceased person's fingerprints in an attempt to get past the protections of Apple's Touch ID technology. Unfortunately for the FBI, Artan's lifeless fingerprint didn't unlock the device. In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said. He sent the device to a forensics lab which managed to retrieve information from the iPhone, the FBI phone expert and a Columbus officer who worked the case confirmed. That data helped the authorities determine that Artan's failed attempt to murder innocents may have been a result of ISIS-inspired radicalization.
Where Moledor's attempt failed, others have succeeded. Separate sources close to local and federal police investigations in New York and Ohio, who asked to remain anonymous as they weren't authorized to speak on record, said it was now relatively common for fingerprints of the deceased to be depressed on the scanner of Apple iPhones, devices which have been wrapped up in increasingly powerful encryption over recent years. For instance, the technique has been used in overdose cases, said one source. In such instances, the victim's phone could contain information leading directly to the dealer.
Is this a problem? (Score:5, Interesting)
Re: (Score:2)
Pathologists already would, depending on the degradation of the corpse, basically take the skin of the fingers off of the body and either put it on a mandrel or else would put it over their own gloved hands as a human-glove to get fingerprints.
I am not surprised in the slightest that investigators would attempt to unlock biometric locks with the biometrics of the deceased. I would be more surprised if they didn't try it. I also wouldn't be surprised if they have to develop techniques to duplicate someone'
Re: (Score:2)
Re: (Score:2)
You don't need to be dead for the cops to force you to unlock your phone with your fingerprint [mashable.com].
Sounds like fingerprint readers need to be repurposed into "reset to factory default" buttons, just use a pin all of the time when the cop forces you to "unlock" the phone he instead wipes it back.
Re: (Score:2)
In the EU it would fall under privacy rules. Even dead people have privacy rights, and of course their surviving family members do.
It depends on the circumstances but there could be issues there.
All about context (Score:2)
Re: (Score:2)
In the EU it would fall under privacy rules. Even dead people have privacy rights, and of course their surviving family members do.
That's the issue for me here as well - when a person dies the police can't legally start confiscating their former property, so why would it be any different with personal effects?
Re: (Score:2)
I'm not sure there is a 4th amendment issue here if the suspect is dead, as they would no longer have an expectation of privacy
That sounds to me like a rationale for looting the property of the deceased; I think next-of-kin would argue the point.
Would be nice if it automatically unlocked (Score:2)
It would be nice if these devices automatically unlocked after some time limit, like 1 year. At least we could get into a device after someone died or after the police confiscated a device long enough, without having to hand over some backdoor keys that compromises the security of all our devices.
There really is no perfect solution that protects our rights and provides security and allows law enforcement to do their job. Some reasonable compromise has to be found. I'm of the mind that our rights has the hig
Re: (Score:3)
Re:Would be nice if it automatically unlocked (Score:4, Insightful)
It would be nice if these devices automatically unlocked after some time limit, like 1 year.
That would imply an application Logic-based lock, but instead, these phones use cryptography so the passcode is required to decrypt the data; "Fingerprint" access only works while the key derived from the passcode is still in volatile memory, and once the phone sleeps or reboots or something, that memory is purged, and the decryption key needs to be supplied again.
If they didn't encrypt the data ---- then everything on your phone could potentially be stolen by a criminal attacking either Apple's servers or the phone itself and finding a flaw in the Logic-based lock.
Re:Would be nice if it automatically unlocked (Score:4, Insightful)
I used to do TPM drivers for embedded systems, it's not that far fetched of a feature to time out when your TPM already has an NVRAM. From NVRAM it's simple to embed an RTC (simple but not free, increases costs by several cents and creates supply chain disruption by introduction of a new variant). There are other ways to deal with this problems as well, and I'm not married to this idea.
My main point is the solution that most of the people on slashdot demand is not really feasible. That solution being to do nothing to disrupt the status quo and lock devices down so that nobody, not even law enforcement, can get into the device. If you can't trust your police and legal system to not violate your rights on your cellphone, how can you trust them in any other aspect of your life? Fix the real problem of corruption and public distrust.
Easy attack [Re:Would be nice if it automatical... (Score:2)
"It would be nice if these devices automatically unlocked after some time limit, like 1 year."
This gives you an easy attack vector: just reset the clock.
Re: (Score:2)
I think you want to reply to the parent, as I have not suggested the time-based unlock is feasible in a secure smart phone.
However, the issue of resetting the clock can be mitigated by requiring the phone to be unlocked to access those settings. Alternatively the "mechanism to unlock after 1 year" could require a digitally signed request that is also countersigned by multiple secure timestamping authorities possessiong X509 security certificates from trusted Root CAs holding the timestamping r
Re: (Score:2)
It would be nice if these devices automatically unlocked after some time limit, like 1 year.
That would imply an application Logic-based lock, but instead, these phones use cryptography so the passcode is required to decrypt the data;
Not really, the PIN is not the key and would not be needed if you could use brute force. And it enforces the timeouts somehow so it has a clock. If it doesn't work to have a one-year clock you have one "decrease unlock clock attempt" per day that always succeeds and if you do that 365 times it unlocks, technically it's not a problem to build it into the system But practically one year later is not a problem for somebody looking for celeb nudes on a stolen phone, the information is still valuable. All the pr
Re: (Score:2)
It would be nice if these devices automatically unlocked after some time limit, like 1 year. At least we could get into a device after someone died or after the police confiscated a device long enough, without having to hand over some backdoor keys that compromises the security of all our devices.
The problem with that is that if someone wants to get your super-secret data, all they have to do is steal your phone, lock it in a safe for a year, and take it out and poof, it's unlocked. That doesn't sound very secure to me.
Re: (Score:2)
Include your passwords and PINs in a document that resides somewhere safe, like a safety deposit box. Your will confers access to it, and then your loved ones can unlock everything.
Dead people tell no passwords (Score:2)
Re: (Score:2)
Is there anyone not ok with this? (Score:3)
And the related question (Score:5, Insightful)
Tell you what. If I'm murdered and the cops think there might be something on my phone that would tell them who murdered me, I'm cool with them using my finger to unlock it.
Apropos of nothing, are you cool with them having an incentive for shooting you rather than taking you in, in order to get at your information?
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
But we aren't talking about a typical cop here, nor about a typical scenario of phones being unlocked, are we?
Re: (Score:2)
Why do you think they won't just order you to use your finger to unlock the phone when alive? Police are already adept at physically forcing you to do things.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Apropos of nothing, are you cool with them having an incentive for shooting you rather than taking you in, in order to get at your information?
They can already use your fingerprint to unlock a phone while you are alive. They don't need to kill you to gain access.
Re: (Score:2)
Compared to what?
If you answer:
Fisherman
Logger
Construction Worker
Roofer
Garbage Collector
Truck Driver
Pilot
Farmer/Rancher
Lineman
Oil Well Operator.
Then no, it is not really that dangerous at all.
Re: (Score:2)
It's only dangerous to be a cop when cops act dangerously.
Re: (Score:2)
Not only that.... but I would be happy to supply my passcode to an agent that would release it to only trusted individuals upon my death.
If only such an agent could exist, and if only there were a place I could trust highly enough to secure my passcode with a strong assurance that the passcode could never be used against me or released prematurely, or against my wishes, or to anyone but highly-trustworthy individuals.....
Re: (Score:2)
AND would be resistant to court orders or warrants?
Good luck finding a way to do that.
Re: (Score:2)
Court orders, warrants, and the informal "we can't compel you, but it would be such a shame if you were to be arrested for something" warrant.
Re: (Score:2)
Re: (Score:2)
Lots of people are single, including me. I have no wife or husband.
And if I had one... I'm not sure it would be wise to entrust them with the passcode, since they would already be inherently trusted with almost everything else or soooo many other things, and there are things that exist called divorces and related risks of being betrayed; that there should be at least a FEW personal resources protected from a spouse... "just in case".
Re: (Score:2)
I mean if we did we should call them Law-ers or something.
Re: (Score:2)
and very powerful protections of their communications built into our legal system.
It sounds great.... I don't know of any lawyers advertising an information filing/retention/release-on-event service that would make this possible though.
Would you know of a service, where I could file documents with release instructions --
and obtain said legal protections in addition to strong technical and physical access controls that would require 2 or 3 employees to be able to verify the authentic
Re: (Score:3)
Tell you what. If I'm murdered [...] I'm cool
Yes. Yes you are.
my wife thought I was crazy... (Score:3)
HOWEVER, where it DOES make sense, is for app access. IOW, once you have unlocked the phone, but an app, say credit card needs to be unlocked again, the finger print makes sense. Kind of wish that we could do say 1-3 prints for the key. That would truly limit the likelihood of somebody being able to use it.
Re: (Score:3)
Well, my first question would be. Has there ever been a documented case of any one being killed so someone can use their finger to unlock their phone?
I believe in being secure. My phone is locked most of the time, unlocked with a pin and a finger print. I also have nova launcher set so that I can lock it and disable the finger print scanner. It also unlocks at my home and if my wireless headphones are attached.
None of these will keep a dedicated police search out of my phone. But they will keep so
Re: (Score:2)
Add to that, the fact that ppl DO have apps on the phones where they can access 100's of 1000s of $. Ppl kill for 100s of $, so, I would guess that if they know, or at least you look it, that you have 100,000+ accessible via your phone and all it takes is your finger to access it, it wil
Re: (Score:2)
"None of these will keep a dedicated police search out of my phone."
Given that it unlocks itself at your home, I'd tend to agree.
" But they will keep someone from wandering by and just going through my phone."
Some of the people most likely to wander by and go through your phone are in your house (where its unlocked): family members, guests, roommates, your guests or THEIR guests.
I'm not saying you should have any reason not to trust your wife, but your 16 your old's best friends' boyfriend my be less reliab
Re: (Score:2)
This is where careful selection of hardware comes.... For instance in the Android ZTE Axon7's fingerprint sensor they reportedly chose to use Goodix's solution that uses Infrared imaging of the print on tissue beneath the surface of the finger which verifies liveness of the finger, and that the print presented is not a simple cosmetic mockup or disembodied finger.
The only concern then is forced access..... Wouldn't TWO-Factor make sense?
Option A quick access: FINGER + 4-digit PIN
Option B on
You can have access to my iPhone... (Score:5, Funny)
...when you unlock it with my cold, dead hands.
Never liked finger-print unlocks (Score:3)
I don't want my dead fingers to be more useful to the cops than my living fingers. That's a bad-mojo sort of incentive brewing right there.
Re: (Score:2)
Re: (Score:2)
I don't want my dead fingers to be more useful to the cops than my living fingers. That's a bad-mojo sort of incentive brewing right there.
They can make you put your living finger on the scanner, so your dead fingers would be equally useful, not more useful.
As for theories that they might shoot you because they don't have probable cause to arrest you, it's much easier to manufacture probable cause than it is to justify shooting. Even if their probable cause gets tossed later, they can still use whatever evidence they got from the device, just not against you. And of course if they kill you they can't use the evidence against you, because you
Re: (Score:2)
A lot of people seem to have forgotten that parallel construction [techdirt.com] is a thing.
Over my dead body! Oh wait... (Score:2)
Heh, this certainly gives new meaning to that expression!
Get a warrant (Score:5, Informative)
Body dead too long? Too bad. Get a warrant.
Druggie too stoned to give consent? Get a warrant.
Want to access my phone FOR ANY REASON? Get a fucking WARRANT.
The good ol' password wins again (Score:3)
You can't steal a password off someone's body, dead or alive.
Re: (Score:2)
You can't steal a password off someone's body, dead or alive.
Rubber hose crypto analysis still applies.
Re: (Score:2)
Non gender specific people, start your hashtags! (Score:2)
Abdul Razak Ali Artan had mowed down a group of people in his car, gone on a stabbing spree with a butcher's knife and been shot dead by a police officer on the grounds of Ohio State University,
Attention, you millennial ornate hexagonal crystals of dihydrogen monoxide! For how much longer are we going to let people ride around in these personal weapons of mass destruction, wielding kitchen utensils that can kill silently at any time? The UK is taking knives away from people now, and so can we. #CarsKillKnivesKillBusesForAll
FBI agent applied the bloodied body's index finger (Score:2)
Am I the only one who noticed?
an FBI agent applied the bloodied body's index finger
Uh... Perhaps using the thumbprint instead would have been better since that is what the iPhone uses?
Re: (Score:2)
Well, it can use any finger you register. I use a thumb and an index finger.
Of course, you only get so many attempts (fewer than 10) so you can't go through all fingers without getting a lockdown.
what if a suspect lost a finger? (Score:2)
*all* rights end at death (Score:2)
I don't care. If you're dead, you should have absolutely zero rights.
Re: (Score:2)
So, when you die, I should be able to just walk into your house and take your stuff? Claim your bank account?
Necromancy (Score:2)
High time too; thieves have been using Hands of Glory [wikipedia.org] for hundreds of years now, it's nice to see the police finally catching up with modern necromantic technology...
I see it! (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Try uBlock Origin.
Lower memory/CPU footprint than a lot of the others, and lots of places don't detect it (like Forbes).
Re: (Score:3)
Why not?
Re: (Score:2)
Why not?
I've heard people complaining that it doesn't always work right after they've been asleep... so it's not surprising it might not work after the Big Sleep.
Re:Wouldn't work with FaceID... (Score:5, Funny)
Apple FaceID requires the person have that smug look of self-importance. Dead faces all appear as Windows users to FaceID.
Re: (Score:2)
In that case Martin Shkreli's face can probably unlock any apple phone with FaceID enabled.
Re: (Score:2)
Just sayin'
Also wouldn't work with a 4 digit pin. Seems like we solved this problem long before it existed.
You don't need to get a payday loan to afford phone security anymore.
You're welcome.
Re: (Score:2)
Just sayin'
Also wouldn't work with a 4 digit pin.
Which has the added advantage that you can't be legally compelled to give up your PIN without a warrant.
Biometrics, not so much.
Re: (Score:2)
We live in a world where $40k cars are common now and you complain that a phone you could use for three to four years costs $1k? You use a phone every day. I use it vastly more often than my car.
I use my coffee mug more than my phone and it cost me about $3. My phone has some features that my mug lacks, just like my car has some features that my phone lacks.
Re: (Score:3)
Most people use their phones hundreds of times a day for many hours. Most people use a coffee mug 1-2 times a day for maybe 30 minutes max.
Who uses a coffee mug 1-2 times/day? Once to brew followed by one huge, scalding gulp? I use my coffee mug for about 8 hours a day. Part of that time I use it to sip coffee; the rest of the time I use it to hold coffee. I use my phone intermittently between 4-9 PM to play Words With Friends, browse Facebook, chat/SMS, and occasionally to make or receive a phone call. Am I that unusual?
Re: (Score:2)
Who in their right might shares PINs with anyone? You may trust your roommate or grandfather, but where I come from, security means security.
I know my parents pin number, and my wife in theory knows my pin number. degrees of trust.
Re: (Score:2)
From another source: [sophos.com]
In theory, Apple’s Face ID authentication is supposed to require eye movement to work. But Marc Rogers, researcher and head of information security at Cloudflare, told Forbes that he’s recently discovered that photos of open eyes work just fine.
A few months ago, Vietnamese researchers did the same thing. With a mask.
Not simple and would not work here (Score:3, Informative)
A simple mask wouldn't work either, you appear to know nothing about FaceiD or technology. Oh you poor Apple Haters!
The mask (singular) you read about unlocking an iPhone X? It was rather complex, requiring a full 3D scan, IR photos of the area round the eyes placed exactly right, which also require a living subject to capture... how are you going to get that photo after they are dead? Your "point" in the end is just more Hater bullshit, pointless in relation to the current article and doing more to hig
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Apple’s Face ID security fooled by simple face mask [sophos.com]
Re: (Score:2)
lol buddy I think you might be getting faceid confused with some other facial unlock feature from a different manufacturer. There is only 1 exploit for faceid, and it requires the person to be alive and available, and to submit to a 3d infrared facial scan. The resulting mask that is created also needs to simulate specific temperatures at the specific points and still resemble the person.
The resultant mask costs $50,000 and the hardware required to make it several hundred thousand.
Oh yes and the target still has to voluntarily submit to a facial scan.
A 10 year old Kinect and a 4 year old FLIR One will copy any face well enough to fool Face ID in a couple of seconds.
Making the mask is trivial. You 3D print a rough mold, then glob silicon on it and paint it. Recreating temperature zones is the "hard" part, but only because you need to actually build something to to that. It doesn't have to be very accurate or precise. FaceID's matching is incredibly fuzzy.
Re: (Score:2)
Re: (Score:3)
You must go to very big parties. The false positive rate is 1 in 1m.
No. (Score:3, Informative)
Trigger happy cops will now be happier. The dead will not resist that caps use its fingerprints to unlock their phone... :(
Proof gathered this way should be invalidated or else cops will be more inclined to kill the suspects to access more easily their phones
Dude. No. No cop I've ever known would kill a drug user just to get a line on the dealer. Climb out of the youtube-hate.
Re: (Score:2)
Re: (Score:2)
Same here. I tracked down a vandal, smashing windshields, because the cops didn't care. When I finally got them to come out they said I was stupid and let the vandal go.
Fuck the police.
Yes, that's a sure sign that that copy would kill somebody for evidence. You nailed it.
I don't think any cop would (Score:2)
Re: (Score:2)
Re: (Score:2)
Yeah, its much easier to get the drug user on charges, turn him into an informant, then give him no support when the drug dealer kills him.
Much easier to convict on a murder charge than a drug dealing one.
Re: (Score:2)
Yeah, c'mon, it's not like cops need an excuse to kill people. They can do it all they want already!
Re: (Score:2)
Nor will the living. At least not successfully. The cops already will just hold your finger on the scanner if you refuse to do it when they tell you (and then charge you with obstruction.)
Re: (Score:2)
spread his message of harmony with his truck of peace.
Heh, this also applies to '60s hippies and all-time pedophiles.
Re: (Score:2)
I think you're confusing Muhammads. Just sayin'...
Re: (Score:2)
But the court CAN require your password and hold you in contempt (and toss you in jail for the duration) for not providing it. Pleading the 5th won't get you out of this.
Also, My I-phone requires that the password be entered before the fingerprint scanner will work.... So if you are a criminal, just power down your phone if you fear you will have to interact with the cops and they won't be able to open your phone in case of your untimely death (or by physically forcing you to apply your finger).
Re:Trigger happier cops (Score:4, Informative)
Police have had a solution to that one for years. It's why the 'no knock' warrant exists - they just need to convince a judge there is reason to believe the suspect will destroy evidence if given the opportunity.
If the police believe you have evidence at your home or on your person, they will get a warrant to search you. But if they believe the evidence is easily destroyed - a phone you can lock, or documents you can burn - then they will break into your home while you are at work. Or smash the door down and force everyone to the floor at gunpoint. Or you'll be walking down the street one moment, and the next two plainclothes officers have snuck up behind you and are pinning you against the wall while they get the cuffs on.
Recall the Dread Pirate Roberts arrest? Police knew his laptop would lock if he closed the lid, so they had to arrest him while he had it open. They used an officer posing as a waitress to get close enough without arousing suspicion, who pinned him to the floor while another ran in to grab the laptop.
This isn't something new. The legal system had had solutions for many years to address the problem of suspects who may destroy evidence if they know they are about to be arrested.
Re: (Score:2)
Re: (Score:2)
Thinking about this.... The problem is that YOU cannot destroy evidence once you become aware that it might be wanted by law enforcement or subject to civil lawsuit.
IF your device is programed to do a secure erase after a given length of time w/o a successful login by you, I suppose that you could conceivably wait that length of time... The key would be that you'd have to specifically NOT take any action to erase the device (like entering the wrong password or something) and that you are not misrepresenti
Re: (Score:2)
But would you be obligated to explain that *before* they ask for the device or take it from you?
Re: (Score:2)
That's a question for your lawyer friend.. I do not know.
The issue is that YOU have the responsibility to preserve any and all information that you reasonably know is relevant to criminal or civil legal actions if you can. You are afforded the right to delete any information as part of an automated processes and can legally delete any and all records/documents prior to becoming aware of the legal action and as long as you are taking reasonable care to preserve any data as soon as you are aware.
The quest
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yes, you are very confused. His 'mowing down group of people' and 'stabbing spree' caused only injuries. The only person to die was Artan who got shot.
So what you're saying is that a good guy with a gun...