An Ohio man currently being prosecuted for possession of child pornography is believed to be the first person to have unlocked his Face ID-enabled iPhone after being presented with a warrant and being ordered to do so by law enforcement.
The case of United States v. Grant Michalski was first reported on September 30 by Forbes.
However, whether or not that purported federal warrant specifically authorized such a search, as authorities claims, is unclear—the warrant appears to be sealed by the court. Ars has been unable to locate a copy to see if the agent's account is accurate. Why this warrant would remain sealed is also unclear, given that a later warrant to specifically search the suspect's phone is public.
For now, the case does not seem to raise any Fourth or Fifth Amendment questions, but it does illustrate the tactics that at least one law enforcement agency has begun to incorporate. Orin Kerr, a law professor at the University of Southern California, one of the nation's top computer-crime experts, said as much on Twitter on Monday.
From a legal perspective, Face ID pretty much raises no legal issues: Obviously no 5th Amendment issues, and pretty much no 4th Amendment issues. Warrant required to search the phone whether locked or not, but no extra legal burden on govt just to wave it in someone's face. https://t.co/erJBgLWaTM
— Orin Kerr (@OrinKerr) October 1, 2018
In other words, courts traditionally have recognized a Fifth Amendment privilege in things that you know (a passcode to a safe) but not something that you are (a biometric). That means Face ID is not likely to be treated, legally speaking, as substantively different than Touch ID.
Ars recently reported that it may be possible for aggressive border agents to unlock a Face ID-enabled phone at a distance of a few feet. In the rest of the country, the Fourth Amendment would prevent law enforcement from doing this, but at the border, there is a strong overriding exception to the amendment's normal protections.
The weakest link
As a 27-page affidavit written by FBI Special Agent David Knight explained, the case began when an Ohio law enforcement officer, Larry McCoy, began posing undercover in January 2018 on Craigslist. McCoy portrayed himself as a "recently divorced father" who was interested in "taboo stuff."
Soon enough, McCoy began corresponding with a man named William Weekley who began sharing child-porn images with McCoy. The investigation into Weekley, who was indicted in January 2018 on similar charges, revealed that Weekley had been corresponding with someone with the email address of [email protected].
Eventually, investigators linked this email address to a Columbus man named Grant Michalski.
According to the September 19 affidavit, the agent who confronted Michalski at his home on August 10 told Michalski that he was "required by law enforcement to place his face in front of an iPhone X" found on Michalski's person when the warrant was executed. Michalski complied, but the phone was only unlocked for a relatively short period of time. But a more thorough examination of the phone could not take place as the "passcode is unknown."
"After Riley, Jones, and Carpenter, I would strongly consider a motion to suppress if the initial warrant said 'house and devices present there' and they seized and did a full forensic search of a mobile smartphone just on that," Fred Jennings, a New York-based computer crime defense attorney, told Ars.
"Without insider knowledge, my best guess for the second search warrant is an abundance of caution about a full smartphone search with the amount of legal uncertainty in that area right now."
Jennings referred to three landmark Supreme Court decisions over the last decade that concluded there is a strong privacy interest in a cell phone and that, in most circumstances, police need a warrant in order to perform such a search.
The September 19, 2018 signed warrant to search Michalski's iPhone (erroneously marked on the first page as an iPhone 8, when in fact it is an iPhone X) first published by Forbes was issued and submitted to the court more than a month after the phone was opened via Michalskis face print at the direction of law enforcement.
If law enforcement already had a warrant to search the phone on August 10, it is not clear why they would have needed a second warrant more than 30 days later, on September 19.
Court records show Michalski was first confronted by law enforcement on August 10 but not actually arrested until August 24. That was just one day after a second superseding federal indictment against five other child-porn defendants (including Weekley) in the region was issued.
Neither Steven Nolder, Michalski's attorney, nor anyone from the United States Attorney's office for the Southern District of Ohio, responded to Ars' request for comment.
[contf] [contfnew] 
Ars Technica
[contfnewc] [contfnewc]
