Why You Should Always Encrypt Your Smartphone

Why You Should Always Encrypt Your Smartphone

January 17, 2011
Originally published in Ars Technica

Last week, California's Supreme Court reached a controversial 5-2 decision in People v. Diaz (PDF)holding that police officers may lawfully search mobile phones found on arrested individuals' persons without first obtaining a search warrant. The court reasoned that mobile phones, like cigarette packs and wallets, fall under the search incident to arrest exception to the Fourth Amendment to the Constitution.

California's opinion in Diaz is the latest of several recent court rulings upholding warrantless searches of mobile phones incident to arrest. While this precedent is troubling for civil liberties, it's not a death knell for mobile phone privacy. If you follow a few basic guidelines, you can protect your mobile device from unreasonable search and seizure, even in the event of arrest. In this article, we will discuss the rationale for allowing police to conduct warrantless searches of arrestees, your right to remain silent during police interrogation, and the state of mobile phone security.

The Fourth Amendment's search incident to arrest exception

It has long been established under common law that law enforcement officers may conduct warrantless searches of criminal suspects upon arresting them. Courts have identified two exigencies that justify warrantless searches of suspects incident to arrest.

First, the government has a compelling interest in ensuring that detained suspects are not in possession of weapons or other dangerous items. Requiring that police obtain a warrant before determining whether an arrested individual is armed would subject officers to potentially life-threatening risks.

Second, the government has a compelling interest in preventing arrestees from destroying or tampering with evidence of criminal activity in their immediate possession at the time of arrest. Imposing a warrant requirement on police searches of arrestees would afford suspects an opportunity to destroy any incriminating evidence on their persons.

Unfortunately, courts have expanded the scope of this once-narrow exception to create a gaping hole in the Fourth Amendment. In 1973, the United States Supreme Court held in US v. Robinson that warrantless searches of arrestees’ persons are presumptively reasonable and require "no additional justification" to be lawful. In 1974, the Court further held in US v. Edwards that objects found in an arrestee's "immediate possession" may be subject to delayed warrantless search at any time proximate to the arrest—even absent exigent circumstances.

In 1977, the Supreme Court clarified the search incident to arrest exception in US v. Chadwick, holding that the warrantless search of a footlocker found in the possession of criminal suspects violated the Fourth Amendment because the search took place after the suspects had been put into custody and the footlocker had been secured by police. In Chadwick, the Court held that while warrantless searches of objects found on arrestees' persons are presumptively lawful due to the "reduced expectations of privacy caused by the arrest," closed containers that are not "immediately associated with" arrestees' persons are not subject to a delayed warrantless search, barring exigent circumstances.

Based on these precedentsCalifornia's Supreme Court held in Diaz that mobile phones found on arrestees' persons may be searched without a warrant, even where there is no risk of the suspect destroying evidence. Therefore, under Diaz, if you're arrested while carrying a mobile phone on your person, police are free to rifle through your text messages, images, and any other files stored locally on your phone. Any incriminating evidence found on your phone can be used against you in court.

On the other hand, if you are arrested with a mobile phone in your possession but not immediately associated with your person, police may not search your phone without a warrant once you’ve been taken into custody and your phone is under police control.

The takeaway from Diaz, therefore, is that you should store your mobile phone in your luggage, footlocker, or in some other closed container that's not on your person, particularly when driving an automobile. (For more on this subject, see our 2008 article summarizing the search incident to arrest exception in the context of mobile phones. Also see The iPhone Meets the Fourth Amendment, a 2008 UCLA Law Review article by law professor Adam Gershowitz.)

What about password-protected mobile phones?

While the search incident to arrest exception gives police free rein to search and seize mobile phones found on arrestees’ persons, police generally cannot lawfully compel suspects to disclose or enter their mobile phone passwords. That's because the Fifth Amendment's protection against self-incrimination bars the government from compelling an individual to divulge any information or engage in any action considered to be "testimonial"—that is, predicated on potentially incriminating knowledge contained solely within the suspect's mind.

Individuals can be forced to make an incriminating testimonial communication only when there is no possibility that it will be used against them (such as when prosecutors have granted them immunity) or when the incriminating nature of the information sought is a foregone conclusion. (For more on this subject, see thisinformative article forthcoming in the Iowa Law Review, also by Professor Gershowitz, which explores in great depth the uncharted legal territory surrounding password-protected mobile phones seized incident to arrest.)

As such, if you are arrested or detained by a law enforcement officer, you cannot lawfully be compelled to tell the officer anything other than your basic identifying information—even if the officer has not read you the Miranda warning. Exercising your right to remain silent cannot be held against you in a court of law, nor can it be used to establish probable cause for a search warrant.

However, if you voluntarily disclose or enter your mobile phone password in response to police interrogation, any evidence of illegal activity found on (or by way of) your phone is admissible in court, regardless of whether or not you've been Mirandized.

What if you're not a criminal and think you have nothing to hide? Why not simply cooperate with the police and hand over your password so that you can get on with your life?

For one thing, many Americans are criminals and they don't even know it. Due to the disturbing phenomenon known as "overcriminalization," it's very easy to break the law nowadays without realizing it. A May 2010 studyfrom the conservative Heritage Foundation and the National Association of Criminal Defense Lawyers found that three out of every five new nonviolent criminal offenses don't require criminal intent. The Congressional Research Service can't even count the number of criminal offenses currently on the books in the United States, estimating the number to be in the "tens of thousands."

What's more, the US Supreme Court has held that police may arrest you for simple misdemeanors, such asdriving without a seatbelt or having unpaid parking tickets. While police don't typically arrest individuals for such trivial infractions, all it takes is one unlucky police encounter and you could end up behind bars. If that happens, and your mobile phone is on your person, it may be subject to a warrantless search. If police dig up an incriminating text message, e-mail, or errant image file on your mobile device, it might be enough to convince a judge to issue a search warrant of your property—or, worse, lead to criminal charges being filed against you.

While police cannot force you to disclose your mobile phone password, once they've lawfully taken the phone off your person, they are free to try to crack the password by guessing it or by entering every possible combination (a brute-force attack). If police succeed in gaining access your mobile phone, they may make a copy of all information contained on the device for subsequent examination and analysis.

Exhaustive cell phone searches aren't exactly commonplace today, but they're growing more and more frequent as law enforcement begins to realize how much incriminating information modern smartphones tend to contain. The rapidly growing digital forensics industryalready offers a range of tools to law enforcement designed for pulling data off of mobile phones, and entire books have been written on such topics as the forensic analysis of the iPhone operating system.

Alarmingly, in many cases, extracting data from a mobile device is possible even if the device password is not known. Such extraction techniques take advantage of widely known vulnerabilities that make it disturbingly simple to access data stored on a smartphone by merely plugging the device into a computer and running specialized forensics software. For instance, Android andiPhone devices are vulnerable to a range of exploits, some of which Ars documented in 2009.

Therefore, if you care about your privacy, password-protecting your smartphone should be a no-brainer. Better yet, you should ensure your smartphone supports a secure implementation of full-disk encryption. With this method of encryption, all user information is encrypted while the phone is at rest. While it isn't absolutely foolproof, full-disk encryption is the most reliable and practical method for safeguarding your smartphone data from the prying eyes of law enforcement officers (and from wrongdoers, like the guy who walks off with your phone after you accidentally leave it in a bar.)

Unfortunately, few consumer-grade smartphones support full device encryption. While there are numerous smartphone apps available for encrypting particular types of files, such as emails (i.e. NitroDesk TouchDown), voice calls (i.e. RedPhone), and text messages (i.e. Cypher), these "selective" encryption tools offer insufficient protection unless you're confident that no incriminating evidence exists anywhere on your smartphone outside of an encrypted container.

Despite the generally sorry state of mobile device security, a few options exist for privacy-conscious mobile phone owners. Research in Motion's BlackBerry, when configured properly, is still widely considered to be the most secure smartphone platform. In fact, BlackBerry's transport encryption is so robust that a few foreign governments have recently forced RIM to install backdoors for law enforcement purposes.

The iPhone 3GS, released in June 2009, marked Apple's first serious attempt to make the iPhone a contender in mobile security. The phone features full-disk encryption by default and can be remotely wiped in seconds. However, as forensics expert Jonathan Zdziarski has discussed, vulnerabilities make it trivially simple to bypass this encryption and extract an unencrypted disk image from the phone in a few minutes' time. As for the remote wipe capability, thieves or law enforcement officers can disable it by removing the iPhone's SIM card.

In June 2010, with the release of iOS 4, Apple took another stab at iPhone security by offering a new optional feature called "data protection," which encrypts certain types of user data when the phone is locked or turned off. While data protection appears to be secure, its use is currently limited to e-mails and to other specific types of user content linked to iPhone apps that take advantage of iOS 4's encryption API.

Google's Android, the world's fastest growing smartphone platform, doesn't natively support any sort of full-disk or device encryption. While Android supports Exchange e-mail, it doesn't support on-device Exchange e-mail encryption (although the feature is supported by several third-party e-mail applications available for Android). However, Motorola has stated that at least two of its Android smartphones—the Droid Pro and the Droid Bionic—will soon offer full encryption. How well these devices actually implement encryption remains to be seen, but even limited encryption will be a big step up for Android users.

Microsoft's newly launched Windows Phone 7 supports a range of robust encryption algorithms for both data-in-transit and data-at-rest, as Microsoft's Rob Tiffany has explained. However, in one important respect, Windows Phone 7 actually marked a step backward in terms of security. Whereas its predecessor, Windows Mobile, supported on-device Exchange e-mail encryption, Windows Phone 7 currently does not. Microsoft has stated that an upcoming patch will address this oversight, but it's not clear when it will be released.

For more on the state of mobile phone security, see this excellent InfoWorld article in which Galen Gruman assesses each major mobile platform's security strengths and weaknesses.

Are warrantless mobile phone searches headed to the US Supreme Court?

California's troubling Diaz ruling might not be the last word on the matter of warrantless mobile phone searches. In 2009, the Ohio Supreme Court heard a similar case (State v. Smith) involving the search of a mobile phone found on an arrestee's person, and reached a very different decision.

In Smith, the court held that mobile phones are distinct from "closed containers," which the US Supreme Court has defined as "any object capable of holding another object." Recognizing that mobile phones, like laptop computers, increasingly contain vast amounts of private information, the court determined that they merit greater privacy protections than other items we typically carry on our persons. Thus, the court held that once police have secured an arrestee's mobile phone, a search warrant must be obtained before the device may be searched.

The Ohio Supreme Court’s conclusion in Smith accords with the framers’ belief that our papers and effects should be protected from unreasonable searches. Indeed, of the many objects we routinely carry on our persons nowadays—including wallets, keys, cigarettes, access cards, pocketknives, and so forth—none tends to contain as much private information as our mobile phones. A typical modern smartphone contains hundreds, if not thousands, of text messages, emails, images, documents, and other kinds of private personal correspondence.

With the ascent of cloud computing, smartphones increasingly provide a window into our private lives, enabling us to access and store practically limitless amounts of sensitive personal data. As ultra-fast 4G wireless networks emerge, mobile devices will likely grow even more intertwined with our digital lives. Just as we have long stored our personal papers and effects in our desks or file cabinets at home, today we're just as likely tostore such information in digital format on cloud services like Windows Live or Google. Thus, the Fourth Amendment demands that mobile phones—a primary gateway to our lives in the cloud—be treated as an extension of the home, rather than mere physical containers analogous to cigarette packs.

California Deputy Attorney General Victoria Wilson, who argued Diaz for the state, has told reporters that the matter of warrantless cell phone searches is ripe for resolution by the US Supreme Court. If that happens, let's hope the nation's high court sides with common sense and reaffirms its 2001 ruling in Kyllo v. US that the Fourth Amendment’s protections must adapt to safeguard our rights as technology evolves.