Skip to content

Add comprehensive legal documentation for biometric vs password protection #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seanieb merged 3 commits into from
Feb 2, 2026
Merged

Add comprehensive legal documentation for biometric vs password protection #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
19f988c
Initial plan
Copilot Feb 2, 2026
1a7af78
Add detailed legal protection information to page
Copilot Feb 2, 2026
ebcc214
Move "Built For" section above "Legal Protection Matters"
Copilot Feb 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
105 changes: 81 additions & 24 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,29 +96,6 @@ <h3>🔴 Full Shutdown</h3>
</div>
</section>

<section id="legal" class="legal">
<div class="container">
<h2>Legal Protection Matters</h2>
<div class="legal-content">
<p class="legal-highlight">⚖️ <strong>Biometrics can be compelled by law enforcement in many jurisdictions</strong></p>
<p>Passwords generally have stronger legal protection under the 5th Amendment in the US. When it matters, forcing password-only authentication adds a critical layer of legal defense.</p>
</div>
</div>
</section>

<section id="use-cases" class="use-cases">
<div class="container">
<h2>High-Risk Situations</h2>
<p class="section-intro">When you need instant password-only security:</p>
<ul class="use-case-list">
<li>🛂 <strong>Border crossings</strong> & security checkpoints</li>
<li>📢 <strong>Protests</strong> or demonstrations</li>
<li>👤 Preventing forced Touch ID access</li>
<li>🚨 Any situation requiring immediate password-only security</li>
</ul>
</div>
</section>

<section id="for-whom" class="for-whom">
<div class="container">
<h2>Built For</h2>
Expand Down Expand Up @@ -147,7 +124,87 @@ <h3>Activists</h3>
</div>
</section>

<section class="cta">
<section id="legal" class="legal">
<div class="container">
<h2>Legal Protection Matters</h2>

<div class="legal-section">
<h3>Passwords vs Biometrics: The US Legal Divide</h3>
<p>US courts are split on whether law enforcement can compel you to unlock a device using biometrics. Passwords and passcodes are generally treated as <strong>testimonial</strong> under the Fifth Amendment, they reveal the contents of your mind and are therefore protected. Biometrics, by contrast, have often been treated as <strong>physical evidence</strong>, more like fingerprints or DNA.</p>
<p>That distinction is now breaking down.</p>
</div>

<div class="legal-case">
<h3>Ninth Circuit — <em>United States v. Payne</em> (April 2024)</h3>
<p>In <em>United States v. Payne</em>, the Ninth Circuit held that <strong>compelling a suspect to unlock a phone using a fingerprint did not violate the Fifth Amendment</strong>.</p>
<p>Police physically grabbed Payne's thumb and used it to unlock his phone after he refused to provide the passcode. The court concluded this did not implicate the Fifth Amendment because the act required <strong>no cognitive exertion</strong> and did not reveal the contents of Payne's mind.</p>
<p>The court analogized the compelled fingerprint unlock to traditional forms of physical evidence collection, such as fingerprints taken during booking or a blood draw.</p>
<p><strong>Holding:</strong> No Fifth Amendment violation.</p>
<p><strong>Source:</strong></p>
<ul>
<li>Ninth Circuit opinion (April 17, 2024): <a href="https://cdn.ca9.uscourts.gov/datastore/opinions/2024/04/17/22-50147.pdf" target="_blank">https://cdn.ca9.uscourts.gov/datastore/opinions/2024/04/17/22-50147.pdf</a></li>
</ul>
</div>

<div class="legal-case">
<h3>D.C. Circuit — <em>United States v. Brown</em> (January 2025)</h3>
<p>The D.C. Circuit reached the opposite conclusion in <em>United States v. Brown</em>.</p>
<p>In that case, the FBI compelled the defendant to unlock his phone using a fingerprint. The court held that this <strong>did violate the Fifth Amendment</strong>, reasoning that the act of unlocking the phone communicated protected facts — including that the defendant knew how to open the device and exercised control over its contents.</p>
<p>Rather than treating biometric unlocking as purely physical, the court emphasized the <strong>implicit testimonial communication</strong> involved in successfully unlocking a personal device.</p>
<p><strong>Holding:</strong> Compelled biometric unlocking was testimonial and unconstitutional.</p>
<p><strong>Sources:</strong></p>
<ul>
<li>D.C. Circuit opinion (Jan. 17, 2025): <a href="https://law.justia.com/cases/federal/appellate-courts/cadc/23-3074/23-3074-2025-01-17.html" target="_blank">https://law.justia.com/cases/federal/appellate-courts/cadc/23-3074/23-3074-2025-01-17.html</a></li>
<li>Arnold &amp; Porter analysis: <a href="https://www.arnoldporter.com/en/perspectives/advisories/2025/03/when-your-fingers-do-the-talking" target="_blank">https://www.arnoldporter.com/en/perspectives/advisories/2025/03/when-your-fingers-do-the-talking</a></li>
</ul>
</div>

<div class="legal-section">
<h3>A Real Circuit Split</h3>
<p>These decisions create a direct circuit split:</p>
<ul>
<li>The <strong>Ninth Circuit</strong> treats biometric unlocking as non-testimonial physical evidence.</li>
<li>The <strong>D.C. Circuit</strong> treats it as testimonial compelled communication.</li>
</ul>
<p>That split makes eventual Supreme Court review likely. Until then, your constitutional protection depends on <strong>where you are</strong>.</p>
</div>

<div class="legal-case">
<h3>Hannah Natanson — <em>Washington Post</em> (January 2026)</h3>
<p>On January 14, 2026, FBI agents executed a search warrant at the home of <em>Washington Post</em> reporter <strong>Hannah Natanson</strong>, seizing her phone, two laptops, and a Garmin watch.</p>
<p>The warrant reportedly included a section explicitly titled <strong>"Biometric Unlock"</strong>, authorizing agents to attempt to unlock seized devices using Natanson's face or fingerprints rather than demanding a passcode.</p>
<p>Natanson had communicated with more than <strong>1,100 confidential sources</strong> using Signal and other encrypted tools. The warrant created a legal pathway to access those communications <strong>without compelling her to disclose a password</strong>.</p>
<p>Security and press-freedom experts warned that biometric unlock provisions collapse the practical barrier between possession of a seized device and access to its encrypted contents.</p>
<p><strong>Sources:</strong></p>
<ul>
<li>Columbia Journalism Review — <em>Nothing Is Secure</em>: <a href="https://www.cjr.org/news/hannah-natanson-fbi-washington-post-raid-devices-seized-runa-sandvik-security-computer-phone-laptop-sources.php" target="_blank">https://www.cjr.org/news/hannah-natanson-fbi-washington-post-raid-devices-seized-runa-sandvik-security-computer-phone-laptop-sources.php</a></li>
<li>Reporters Committee for Freedom of the Press explainer: <a href="https://www.rcfp.org/fbi-raid-washington-post-explainer/" target="_blank">https://www.rcfp.org/fbi-raid-washington-post-explainer/</a></li>
</ul>
</div>

<div class="legal-section">
<h3>US Border Searches</h3>
<p>At US ports of entry, Customs and Border Protection (CBP) can search electronic devices without a warrant. The more complex question is what they can <strong>compel</strong>.</p>
<p>If your device is protected by a <strong>password</strong>, you may refuse to provide it. CBP can seize the device, but the encryption barrier remains legally and technically intact.</p>
<p>If <strong>biometrics</strong> are enabled, that barrier may not exist. Agents can potentially unlock your device using your face or fingerprint — sometimes without your cooperation, and in some jurisdictions without violating the Fifth Amendment.</p>
<p>For people carrying privileged or sensitive material, journalists protecting sources, lawyers with client communications, activists with vulnerable contacts, disabling biometrics before reaching the border restores the legal distinction between <em>possessing</em> a device and <em>accessing</em> its contents.</p>
<p><strong>Sources:</strong></p>
<ul>
<li>EFF — Border Searches: <a href="https://www.eff.org/issues/border-searches" target="_blank">https://www.eff.org/issues/border-searches</a></li>
<li>Cornell University — Digital Privacy at the Border: <a href="https://global.cornell.edu/travel/planning/traveling-technology/digital-privacy" target="_blank">https://global.cornell.edu/travel/planning/traveling-technology/digital-privacy</a></li>
</ul>
</div>

<div class="legal-section">
<h3>International: Compelled Disclosure Laws</h3>
<p>In some countries, the biometrics-versus-password distinction is legally irrelevant: the law may criminally compel password disclosure.</p>
<p>Even then, the difference matters.</p>
<p>With passwords, you retain agency, you may refuse and face legal consequences. With biometrics enabled, that choice may be taken from you entirely.</p>
</div>
</div>
</section>

<section id="use-cases" class="use-cases">
<div class="container">
<h2>Ready to Secure Your Mac?</h2>
<p>Get the panic button your Mac deserves.</p>
Expand Down
114 changes: 113 additions & 1 deletion styles.css
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,7 +350,7 @@ nav {
font-size: 32px;
font-weight: 700;
text-align: center;
margin-bottom: 25px;
margin-bottom: 40px;
color: var(--text-color);
}

Expand All @@ -374,6 +374,118 @@ nav {
color: var(--text-light);
}

.legal-section {
max-width: 900px;
margin: 0 auto 40px;
padding: 25px 30px;
background-color: var(--background);
border-radius: 12px;
box-shadow: var(--shadow);
text-align: left;
}

.legal-section h3 {
font-size: 22px;
font-weight: 600;
margin-bottom: 15px;
color: var(--text-color);
}

.legal-section p {
font-size: 16px;
line-height: 1.7;
color: var(--text-color);
margin-bottom: 15px;
}

.legal-section ul {
margin: 10px 0 0 20px;
padding: 0;
}

.legal-section ul li {
font-size: 16px;
line-height: 1.7;
color: var(--text-color);
margin-bottom: 8px;
}

.legal-section strong {
font-weight: 600;
color: var(--text-color);
}

.legal-section em {
font-style: italic;
}

.legal-section a {
color: var(--primary-color);
text-decoration: none;
word-break: break-all;
}

.legal-section a:hover {
text-decoration: underline;
}

.legal-case {
max-width: 900px;
margin: 0 auto 40px;
padding: 25px 30px;
background-color: var(--background);
border-left: 4px solid var(--primary-color);
border-radius: 12px;
box-shadow: var(--shadow);
text-align: left;
}

.legal-case h3 {
font-size: 22px;
font-weight: 600;
margin-bottom: 15px;
color: var(--text-color);
}

.legal-case p {
font-size: 16px;
line-height: 1.7;
color: var(--text-color);
margin-bottom: 15px;
}

.legal-case ul {
margin: 10px 0 0 20px;
padding: 0;
list-style: none;
}

.legal-case ul li {
font-size: 15px;
line-height: 1.6;
color: var(--text-color);
margin-bottom: 8px;
}

.legal-case strong {
font-weight: 600;
color: var(--text-color);
}

.legal-case em {
font-style: italic;
}

.legal-case a {
color: var(--primary-color);
text-decoration: none;
word-break: break-all;
}

.legal-case a:hover {
text-decoration: underline;
}

/* Use Cases Section */
.use-cases {
padding: 50px 20px;
Expand Down