A US judge last week denied police a warrant to unlock a number of devices using biometrics identifiers like fingerprints and faces, extending more privacy to device owners than previous recent cases.

The order comes from Northern California Federal District Judge Kandis Westmore in response to a request by the government to search and seize the devices found at a premises in Oakland, California, connected to two suspects.

The suspects are believed to be involved an attempt to extort payment from a victim through Facebook Messenger by threatening to release an embarrassing video.

Judge Westmore in her order found authorities did have probable cause to apply for search warrant but denied the request because it was overly broad for not being restricted to the two individuals under investigation.

Instead, the warrant would have allowed authorities to seize and search any device found at the location in question, and to force the unlocking of said devices – no matter who they belonged to – by compelled use of biometric controls. In this case applying the owner's finger to a fingerprint sensor if present or holding the device up to owner's face if it relies on a system like Apple's Face ID or Samsung's iris scanner.

The government, the judge said, is free to submit a more narrow search warrant application, but she made clear that she believes device owners should not have to testify against themselves, in accordance with US Fifth Amendment protection.

"Even if probable cause exists to seize devices located during a lawful search based on a reasonable belief that they belong to a suspect, probable cause does not permit the Government to compel a suspect to waive rights otherwise afforded by the Constitution, including the Fifth Amendment right against self-incrimination," she wrote in her order.

Last June, the US Supreme Court ruled in Carpenter v. US that the government violated the Fourth Amendment – which protects against unreasonable searches and seizures – by collecting cell phone location records without a warrant. It was an major privacy victory and a sign that the Supreme Court is willing to address issues raised by changing technology.

Privacy advocates have also argued that authorities should not be able to force people to unlock their devices because compelled production of passwords is testimonial.

Courts have accepted that where the evidence being sought was not already known to authorities and other exceptions don't apply. But they've not extended protection to biometric identifiers; authorities have been allowed, for example, to apply people's fingerprints to device fingerprint sensors to open seized devices.

Where in the past judges have drawn a distinction between forcing a person to reveal a known password and the act of applying a person's finger to a sensor, Judge Westmore sees no difference in this instance. "In this context, biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent," she wrote.

In a phone interview with The Register, Greg Nojeim, director of the Freedom, Security and Technology Project at the Center for Democracy & Technology, said the courts disagree about whether faceprints and fingerprints can be considered testimonial.

"It is a significant ruling because the other cases in which judges held that fingerprints or faceprints were not testimonial came before the Supreme Court's decision in Carpenter case," he said. "Now you've got a magistrate judge relying in the reasoning of the Supreme Court that digital is different."

Legal scholars have suggested the ruling could be challenged. Last year, when an Ohio man was forced to provide access to his Face ID-protected iPhone (US v. Grant Michalski), USC Gould law professor Orin Kerr, said at the time via Twitter that he saw no Fifth Amendment issues. He showed similar skepticism in a tweet on Monday by questioning the judge's Fifth Amendment reasoning.

Nojeim suggests the Supreme Court may have to clarify the situation.

"Nowadays most everybody is protecting the contents of their cell phones and other devices with passwords," he said. "It's therefore likely this issue will be of growing importance to law enforcement and that makes the chance of Supreme Court review higher than it has ever been." ®

Breach Response , Cybercrime , Cybersecurity

The organization that manages IT, including cybersecurity, for Singapore's public healthcare sector says it has terminated, demoted or financially penalized several employees for their roles in the handling of a 2017 cyberattack on SingHealth, the island nation's largest healthcare group. The breach affected 1.5 million individuals.

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

The actions by the Integrated Health Information Systems Pte. Ltd., or IHiS, come in the wake of a report issued last week by a Committee of Inquiry, a government appointed group designated to examine the breach at SingHealth (see: Lessons From Report on Massive Singapore Healthcare Hack.)

IHiS is Singapore's Ministry of Health's division responsible for administering and operating SingHealth's Sunrise Clinical Manager database, containing patient's electronic health records. U.S.-based Allscripts sells the Sunrise system.

The 2017 cyberattack on SingHealth impacted 1.5 million individuals.

The disciplinary measures that IHiS is taking with its employees in the aftermath of the SingHealth cyberattack differ from the approach often taken in the U.S. healthcare sector, some security experts say.

"Based on my experience in healthcare in this country, it runs counter to the approach we typically take [in the U.S.]," says former healthcare CIO David Finn, executive vice president at security consultancy CynergisTek. The U.S. approach, he says, "is completely aligned with building a culture of security. The trick is to focus on getting the problem fixed so it doesn't happen again, not blaming and punishing people."

But other observers argue that if IHiS failed to impose some kind of sanctions on employees who knowingly violated policy and procedures, that would send the wrong message to its workforce.

Key Findings

IHiS' responsibilities include cybersecurity, security incident response and reporting. Key findings of the committee report on the SingHealth cyberattack included criticism of how certain IHiS employees and leaders handled the cyberattack, including:

The report also found that a number of vulnerabilities, weaknesses and misconfigurations in the SingHealth network and SCM system - many of which could have been remedied before the attack - contributed to the attacker's success in obtaining and exfiltrating the data.

The committee report also laid out more than a dozen recommendations for IHiS addressing the security weaknesses and other issues that contributed to the cyberattack. The top recommendations include adopting an enhanced security structure and readiness; improving staff awareness on cybersecurity to enhance capacity to prevent, detect and respond to security incidents; and enhancing security checks on critical information infrastructure systems.

Disciplinary Actions

In a Jan. 14 statement, IHiS says it formed an independent human resources panel to examine the roles, responsibilities and actions of the IHiS staff involved with the incident and assess the appropriate HR actions to be taken. As a result, IHiS decided to:

How U.S. Approach Differs

In the U.S., most healthcare organizations take an approach that promotes system improvements over individual punishment after a security incident, Finn contends. This approach holds organizations accountable for the systems they design and for how they respond to staff behaviors fairly and justly, he says.

"This is really an approach that holds individuals accountable for their actions but fixes problems by addressing the bigger issues around people, processes and technology rather than simply punishing a few carefully chosen individuals - who may be scapegoats or who may be ultimately responsible for the problem," he says.

While managing people and individual accountability is very important in business, particularly around critical functions, including security, it's imperative to balance carrots with sticks, Finn contends.

"Fining individual managers and demoting employees doesn't really build a supportive, collaborative culture," he argues. "It may, in fact, lead to more of the behavior that they are trying to overcome - hiding information, not escalating bad news and keeping potential problems from non-IT executives who must be involved in decision making."

Blame Game?

Keith Fricke, principle consultant at tw-Security, points out: "Some corporate cultures focus on the issues and what to fix, while others look for someone to blame."

Addressing breach issues requires an appropriate mix of addressing the root causes and holding people accountable, he contends. "Responsibilities for the root causes of a breach may lie in different areas depending on circumstances. For example, it is one thing if an organization provides training for IT workers to understand and implement security processes and tools and these workers fail to apply that knowledge," he says. "It is another thing if the IT workers have requested training or bringing in third parties to help them and the organization denied funding, leaving the workers to do their best with what they have."

Who should be held accountable depends on the situation, Fricke argues. "Another key concept is that someone with technical competence does not automatically ... have incident response competence."

Appropriate Approach?

Other U.S. security experts, however, argue that say IHiS is taking an appropriate approach by imposing sanctions on some employees.

"As suggested in the report, it might seem harsh given the sophistication of the attack. Nevertheless it appears that the sanctioned individuals had the responsibility, resources and ability to follow internal policies and procedures yet chose not to," says Jon Moore, chief risk officer at security and privacy consultancy Clearwater Compliance.

"Failing to implement some sort of sanction for knowingly violating policy and procedures would send the wrong message if as one would believe the intent is to increase the discipline with which the organization operates it cybersecurity program."

Moore says IHiS taking the initiative to commend staff members who excelled in their actions following the cyberattack also is a good move.

"It's as important, if not more important, to incentivize the behavior that we want, as it is to punish the behavior that we do not want," he says. "To the extent that these folks went above and beyond their responsibilities to minimize the impact of this attack, it should be recognized and rewarded."

Other Steps

To fortify cybersecurity safeguards, IHiS says it has accelerated implementation of 18 cybersecurity measures and is bolstering "staff engagement and training" to improve workforce awareness on cybersecurity.

Among those measures are steps to address advanced persistent threats, including detecting indicators of compromise, recording and monitoring endpoint system-level behaviors and events, detecting advanced malware and removing the threats. Two-factor authentication is also being implemented for endpoint local administrators who manage end-user devices and installation of software, IHiS said in a statement issued in November.

IHiS also says it's studying the findings and recommendations in the committee report. "Further improvements are being made to redefine our cybersecurity strategy and make our cyber defense safeguards more robust," it says.

IHiS did not immediately respond to an Information Security Media Group request for additional information, including details about the "significant" and "moderate" financial penalties being levied.