Riley v. California: Warrantless Cell Phone Searches Explained

A Virginia circuit court judge ruled that while police cannot force individuals to enter their own passwords (protected by the Fifth Amendment's self-incrimination clause), they can compel biometric authentication like fingerprint scans to unlock devices, creating a legal loophole where biometric data may be more accessible than passwords despite serving the same security purpose.

The Fifth Amendment protects against self-incrimination, but its application to phone unlocking is unclear. Virginia v. Boss (2014) established that fingerprints are not protected because they are not testimonial, while passcodes may be protected as communicative acts. State courts have ruled that fingerprint unlocking is not protected, comparing it to blood draw requirements in DWI cases. The distinction between testimonial and non-testimonial evidence creates a 'razor-thin' line that determines whether Fifth Amendment protections apply.

The Fifth Amendment protects what you know (verbal information) but does not necessarily protect who you are (physical identification), meaning officers may attempt to use biometric features like Face ID or fingerprints to access your phone, and you should clearly state 'Officer, I will not provide my fingerprint, face, or voice to unlock my phone' to assert your rights.

In 2024, the Ninth Circuit Court ruled in US v. Pain that law enforcement does not need a warrant to unlock a phone using biometrics (Face ID or fingerprint) and access all contents. The court determined that using biometrics requires no cognitive exertion, so it does not violate the Fifth Amendment right against self-incrimination. However, law enforcement cannot compel you to enter a passcode or punch in the code to unlock your phone.

In United States v. Payne (Ninth Circuit, April 2024), courts ruled that fingerprint unlocking a phone is not protected by the Fifth Amendment because it requires no cognitive exertion—it is considered a physical key like a blood draw or fingerprinting at booking. This ruling applies to nine western states (California, Oregon, Washington, Nevada, Arizona, Idaho, Montana, Hawaii, Alaska). Face ID follows the same reasoning. The only protection is using a passcode, which requires memory and is testimonial. Drivers should disable biometrics and use passcodes only, stating 'I do not consent to a search of my phone' on camera during stops.

The third-party doctrine originated in Supreme Court cases from the 1970s, predating the internet. In one case, the Court ruled that financial records given to banks were not protected under the Fourth Amendment because individuals had voluntarily shared them with a third party. In another case involving phone records, the Court applied the same reasoning. The entire internet runs on third-party servers, with all telemetry sent to countless companies worldwide. The doctrine has been applied to everything in modern life, including medical records, attorney-client communications, and cloud-stored data, creating a fundamental challenge to privacy protections.

One of four unresolved fault lines in digital privacy law concerns whether the third party doctrine still applies to integrated cloud data. The third party doctrine states that when you voluntarily share information with a third party like a bank or phone company, you lose Fourth Amendment protection over it. Historically, this made sense because you chose to tell your bank your transactions or your phone company what numbers you dialed. However, when Apple's features automatically sync health data, location, messages, and photos to iCloud, the question becomes whether you meaningfully chose to share that with a third party, or whether you simply used your phone as configured out of the box. Courts are split on this issue, and the Supreme Court has not resolved it.

In a series of 1970s Supreme Court cases, the Court held that when individuals voluntarily divulge information to third parties, they waive their constitutional protection over that information. While this doctrine may have been reasonable when applied to single bank records, it now means that storing almost our entire lives in digital clouds with internet services provides no constitutional protection. A handwritten diary in a drawer requires a warrant for government access, but the same content stored as a Google Document in the cloud receives no Fourth Amendment protection.

This segment explains the third party doctrine and its application to digital records. The host explains that the third party doctrine is a legal principle that states individuals have no reasonable expectation of privacy in information they voluntarily share with third parties. The host explains that when customers sign up for services like Amazon or AT&T, they agree to terms of service that allow the company to share information with law enforcement when there is a court order. The host explains that the court found that the defendant had relinquished any privacy interest in his Amazon and Apple records by voluntarily creating accounts and making purchases. The host notes that the court found that the defendant did not have a privacy interest in the records protected by the Fourth Amendment or the Idaho Constitution.

The border search exception is a Supreme Court doctrine allowing CBP to search electronic devices at US borders without warrants, probable cause, or suspicion. This stems from the principle that borders are special zones with weaker constitutional protections. Key cases include United States v. Ramsay (1976) upholding warrantless mail searches, United States v. Flores (2004) affirming vehicle searches without suspicion, and Riley v. California (2014) clarifying that phones contain 'privacies of life' requiring warrants inland. However, Riley does not apply at borders. In 2024, CBP searched over 47,000 devices—more than five phones hourly—representing a 900% increase from 2015. Basic searches (texts, emails, photos) require no suspicion, while advanced forensic searches (deleted files, metadata, GPS logs) require only 'reasonable suspicion' based on vague factors like nervous behavior or ethnic profiling.

In Gassan Al-Assad v. Department of Homeland Security, the district court ruled that Border Patrol and ICE's electronic device searches at borders violated the Fourth Amendment because the searches were non-routine and required reasonable suspicion, applying the logic of Riley v. California that cell phones contain vast amounts of personal information warranting warrant protection, even though the government has heightened authority at borders.

Riley v. California established that police must obtain a warrant to search the content of a cellphone seized from an arrested individual. The Court analyzed traditional search incident to arrest rationales (officer safety and evidence preservation) and found them less compelling for digital data. The Court emphasized strong privacy interests in digital data, identifying quantitative differences (immense storage capacity, multiple data types) and qualitative differences (sensitive information like browsing history, health data, location history). Riley's warrant requirement extends beyond cellphones to other digital devices with significant storage capacity. The government maintains it can search electronic devices at US borders without a warrant or suspicion, applying to both entry and exit searches. The CBP 2018 directive distinguishes between 'advanced searches' requiring reasonable suspicion and 'basic searches' requiring no suspicion. A 'national security concern' exception allows searches without suspicion. Device searches have increased from 8,500 in 2015 to over 30,000 in 2017. Appellate courts have taken different approaches to applying Riley at the border, with the Ninth Circuit requiring reasonable suspicion for forensic searches, the Fourth Circuit finding individualized suspicion must be in place, and the Eleventh Circuit holding no heightened suspicion is required.

The Supreme Court should apply the Riley v. California precedent to border searches, concluding that the traditional border search exception does not apply to digital devices because digital evidence fundamentally differs from physical evidence—it can be copied infinitely, transmitted globally instantly, and exists simultaneously in multiple locations, making the government's interest in preventing contraband from entering the country modest compared to the significant privacy invasion of warrantless digital searches.

US border searches operate under the border search exception allowing routine searches without warrants. Non-routine searches requiring additional legal process are defined as highly intrusive or conducted offensively. Forensic data copying requires legal process while manual searches do not. The Riley v. California Supreme Court ruling established warrantless phone searches are unconstitutional due to sensitive data contained. Current litigation challenges warrantless device searches at borders, seeking to apply Riley precedent to establish constitutional requirements for digital device searches.