Last month, law enforcement officers showed up at the lab of Anil Jain, a professor at Michigan State University. Jain wasn’t in trouble; the officers wanted his help.
Jain is a computer science professor who works on biometric identifiers such as facial recognition programs, fingerprint scanners and tattoo matching; he wants to make them as difficult to hack as possible. But the police were interested in the opposite of this: they wanted his help to unlock a dead man’s phone.
Jain and his PhD student Sunpreet Arora couldn’t share details of the case, since it’s an ongoing investigation, but the gist is this: a man was murdered, and the police think there might be clues to who murdered him stored in his phone. But they can’t get access to the phone without his fingerprint or passcode. So instead of asking the company that made the phone to grant them access, they’re going another route: having the Jain lab create a 3D printed replica of the victim’s fingers. With them, they hope to unlock the phone.
Arora described how this works. The police already have a scan of the victim’s fingerprints taken while he was alive (apparently he had been arrested previously). They gave those scans to the lab, and using them Arora has created 3D printed replicas of all ten digits.
“We don’t know which finger the suspect used,” he told Fusion. “We think it’s going to be the thumb or index finger—that’s what most people use—but we have all ten.”
A 3D printed finger alone often can’t unlock a phone these days. Most fingerprint readers used on phones are capacitive, which means they rely on the closing of tiny electrical circuits to work. The ridges of your fingers cause some of these circuits to come in contact with each other, generating an image of the fingerprint. Skin is conductive enough to close these circuits, but the normal 3D printing plastic isn’t, so Arora coated the 3D printed fingers in a thin layer of metallic particles so that the fingerprint scanner can read them.
It’s not a foolproof method yet. Arora is still refining the technology, and they haven’t yet given the fingers back to the police to try and unlock the victim’s phone. But Arora said that in a few weeks, once he’s tested the fingers enough in the lab, he’ll hand them over. Then the police will try to use 3D printed models of a dead man’s fingers to unlock his phone.
The security and privacy of phones has been a heated topic in the news lately. You probably remember that Apple and the FBI went back and forth in court over gaining access to the iPhone of the deceased San Bernardino shooter; it was locked with a passcode. This case is a bit different because the cops don’t need a phone company’s help. And the fact that the owner of the phone is dead eliminates some of the legal issues that would usually arise, said Bryan Choi, a researcher who focuses on issues of security, law and technology.
“The Fifth Amendment protects against self-incrimination. Here, the fingerprints are of the deceased victim, not the murder suspect. Obviously, the victim is not at risk of incrimination,” Choi said by email. And even if law enforcement found evidence of other crimes on the phone, the victim is dead, so it’s not like they’d be bringing him to trial anyway.
Where it gets more murky, and more interesting, is thinking about whether this kind of technology can and should be used in other cases, involving living suspects. If this works, to get into someone’s phone locked by a thumbprint, cops would just need the person’s fingerprints… and a court order: In 2013, the Supreme Court ruled that police need to have a warrant to search the contents of a personal cell phone.
According to the courts, there is actually a distinction between a fingerprint password and a memorized one. “Courts generally draw a line between the ‘contents of the mind’ (which is protected) and ‘tangible’ bodily evidence like blood, DNA, and fingerprints (which is not),” Choi said.
So a password that you have memorized may be protected by the Fifth Amendment. Your fingerprints aren’t. In 2014, a court in Virginia ruled that a suspect can be required to unlock their phone using their fingerprint. But the judge in that case said that asking the suspect to divulge his memorized password would be out of bounds.
Choi has argued that phones should be considered extensions of our minds and should be protected under the Fifth Amendment (protection against self-incrimination) and not just the Fourth Amendment (protection against illegal search and seizure). He argues that cell phones are unlike almost anything else we own.
“We offload so many of our personal thoughts, moments, tics, and habits to our cellphones,” he said in his email. “Having those contents aired in court feels like having your innermost thoughts extracted and spilled unwillingly in public.”
That point of view would require courts to recognize that we are all cyborgs, whose minds live in part on our phones.
Arora told me he wasn’t sure how the police department found out about their work. “I think these guys also go online to figure out stuff about how to hack phones,” he said, “so we probably popped up.”
And Jain said he was happy to help when they got in touch: “We do it for the fun.”
But if it works, it might be the first time that a dead person’s 3D printed fingerprint has been used to unlock their own phone.
