NJ Supreme Court rules you can be forced to give up your phone's passcode

Using a passcode instead of biometric authentication may no longer protect your data from law enforcement.

Reported by northjersey.com, the New Jersey Supreme Court ruled Monday that a criminal defendant can be forced to provide the passcode to their phone to investigators. The court rejected the argument from the defense that this violated one's rights against self-incrimination guaranteed by the Fifth Amendment of the United States Constitution.

In a closely watched case, the state's top court narrowly sided with prosecutors seeking access to the phone data of a former Essex County sheriff's officer accused of secretly working with a Bloods street gang. The court ruled 4-3, in a case that could have far-reaching implications for criminal investigations in New Jersey.

The court ruled in favor of the state prosecutors who said that, since the defendant provided the information contained within the device during questioning, that he should be required to provide access to the phone due to the "foregone conclusion exception" to the Fifth Amendment.

The state argued that even if the passcodes were considered testimony, Andrews should be required to provide them under a body of case law known as the "foregone conclusion exception" to the Fifth Amendment. The Prosecutor's Office said Lowery told investigators about the text messages, which it used as a basis to obtain the search warrant. Thus, the texts were a "foregone conclusion" — they were known to exist — and the only thing stopping the state from seeing those potential pieces of evidence was Andrews, who knew the passcode.

Charles J. Sciarra of Clifton, the attorney for the defendant, says that the decision sets a dangerous precedent that could allow law enforcement to more easily invade people's privacy.

"The court's decision is a major defeat to the United States Constitution when it is already under substantial attack ... Forget alleged criminal conduct: It's time to rethink whether you should keep anything simply private or personal on a personal electronic device because if the government wants it, they can now get it ... If you are in a car accident they can go through your whole phone to see if you were a distracted driver."

Megan Iorio, counsel for the Washington-based Electronic Privacy Information Center, however, says that the ruling only allows law enforcement to operate under a microscope and does not have the wide-ranging impacts that most fear.

"The court emphasized that the search warrant in this case was significantly narrowed by a trial court order, and that decision did not give law enforcement license to conduct a 'fishing expedition,' ... Law enforcement will find it difficult to use Andrews to compel decryption of the broad contents of a phone."

Previous rulings have allowed law enforcement to force people to authenticate their phones to allow access using biometrics like Face ID, so many in the privacy space have recommended only having a passcode set to protect your data. This latest ruling, however, could begin to put that kind of protection at risk as well.