Is your face a key or a password?

Depends on who you ask and which court you’re standing in front of

May 31, 2026

Earlier this year, federal agents raided the Virginia home of Washington Post reporter Hannah Natanson. They weren’t there to arrest her, and she wasn’t suspected of a crime. Instead, agents were there to seize her phone and computers as part of an investigation into the alleged leak of classified information from a Pentagon contractor.

Armed with a search warrant, agents entered Natanson’s home where she told them she owned a laptop and a phone, according to a government filing. She said both were upstairs. Agents seized them, along with a hard drive and even Natanson’s smartwatch.

But the search took a turn when agents found a red backpack in her kitchen, which—despite Natanson’s earlier claim that she only had one laptop—held a second MacBook Pro. They opened the lid and it prompted for a TouchID scan. Natanson insisted that she did not use biometrics on her devices, but they told her to try anyway. When she put her index finger on the reader—the laptop unlocked.

Putting aside what’s been described as a “highly unusual” move by federal agents that threatens press freedom, the search and seizure of Natanson’s devices highlights an ongoing rift in the law regarding the right against self-incrimination and how and when the government can compel you to unlock your devices.

The Fifth Amendment provides that no person “shall be compelled in any criminal case to be a witness against himself.“ This is the right not to be compelled to say things that might incriminate you.

But a key limitation of the Fifth Amendment is that it protects testimonial evidence. That’s generally described as anything that would require a person to divulge the “contents of his mind.” In short, these are things you have seen, heard, or know. For example, most courts find that you cannot be compelled to reveal a password for your devices because doing so requires you to divulge something testimonial.

But the Fifth Amendment does not protect against non-testimonial evidence, which can include physical traits such as your fingerprints. For example, if you’re arrested and booked into jail, authorities can take your fingerprints even though doing so might end up incriminating you. This is because fingerprints are just physical characteristics and furnishing them doesn’t require you to reveal anything testimonial.

This distinction is important when it comes to a person’s ability to invoke their Fifth Amendment privilege against self-incrimination. But it’s not clear right now whether using biometrics on your device is more like a password and therefore testimonial, or simply a physical attribute and therefore non-testimonial.

Most of you probably use biometrics to unlock your phone. Millions of Americans use their face or fingerprint to safeguard their photos, conversations, bank information, and other highly personal details.

But courts don’t agree yet on whether the government can access all that information by compelling you to provide your fingerprint or facial scan, or whether doing so is protected under the Fifth Amendment.

In recent years, two federal appeals courts have weighed in on the issue. In 2024, the Ninth Circuit in United States v. Payne ruled that a face or fingerprint scan is just a physical act. It requires “no such mental process,” which means it is not testimonial in nature. As such, the court said people could be compelled to unlock their devices via their biometrics.

In this case, the court said biometrics were more like producing a key to a safe rather than producing a combination. One is just a physical act, while the other requires divulging something a person knows.

But in 2025, the D.C. Circuit in United States v. Brown found the opposite. The court ruled that compelling someone to unlock their phone with their thumbprint can be testimonial and violate a person’s Fifth Amendment rights.

This is because the court said not all physical acts are non-testimonial. In fact, when someone is compelled to unlock their phone with their fingerprint, the court said doing so communicates several things they must know, including how to open the device, that they know they have control over and access to the device, and which specific fingers will unlock the device.

“[T]he compelled opening of a cellphone itself directly announces the owner’s access to and control over the phone, as well as his mental knowledge of how to unlock the device.” ~ United States v. Brown

The laptop found in the red backpack in Natanson’s kitchen seems to be exactly the kind of situation the D.C. Circuit contemplates.

When agents found that second computer, they did not know whose computer it was. It could have been Natanson’s, but it also could have been a friend’s that was left in her house. But when they told her to try unlocking the device with her finger and it worked, the act communicated several things that she must have known about the device.

Under the D.C. Circuit’s framework, she first demonstrated that she knew the device could be unlocked with biometrics (this may be obvious, though, as the computer prompted for TouchID). Second, despite allegedly telling agents she only had one computer, she demonstrated that she had control over and access to the second laptop. Third, despite allegedly telling agents she didn’t use biometrics, she demonstrated that she knew her index finger would unlock the device.

Now, imagine if there had only been a password prompt. Courts have generally found that the Fifth Amendment protects against compelling someone to reveal their password because it’s testimonial—the warrant used to search Natanson’s home even barred agents from demanding that Natanson reveal any passwords. So had there only been a password, what would agents be able to say about the laptop in the red backpack? Not much.

The search of Natanson’s home and devices is just an example, however. Again, she was not the target of the investigation and she wasn’t suspected of any crime. As such, her Fifth Amendment rights with regard to the devices weren’t really at issue. But her case does seem to demonstrate the difficulty courts have had in nailing down whether biometrics are more like a key, i.e., a mere physical act of production, or whether they are more like a password that requires a person to communicate things that an individual knows about the device in question.

It’s a significant open question as millions of Americans are walking around right now with phones and devices that contain their most sensitive personal information, but are protected only by a single gatekeeper: their face or fingerprint. And it’s not clear whether—and under what circumstances—the government can or cannot compel people to use them.

Discussion about this post

Ready for more?