IE 11 is not supported. For an optimal experience visit our site on another browser.

Give up your password or go to jail: Police push legal boundaries to get into cellphones

“The world should know that what they’re doing out here is crazy,” said a man who refused to share his passcode with police.
Illustration of three police offers forcing a hand to enter a phone passcode.
As police now routinely seek access to people’s cellphones, privacy advocates see a dangerous erosion of Americans’ rights, with courts scrambling to keep up.Max Guther / for NBC News

William Montanez is used to getting stopped by the police in Tampa, Florida, for small-time traffic and marijuana violations; it’s happened more than a dozen times. When they pulled him over last June, he didn’t try to hide his pot, telling officers, "Yeah, I smoke it, there's a joint in the center console, you gonna arrest me for that?"

They did arrest him, not only for the marijuana but also for two small bottles they believed contained THC oil — a felony — and for having a firearm while committing that felony (they found a handgun in the glove box).

Then things got testy.

As they confiscated his two iPhones, a text message popped up on the locked screen of one of them: “OMG, did they find it?”

The officers demanded his passcodes, warning him they’d get warrants to search the cellphones. Montanez suspected that police were trying to fish for evidence of illegal activity. He also didn’t want them seeing more personal things, including intimate pictures of his girlfriend.

So he refused, and was locked up on the drug and firearms charges.

Five days later, after Montanez was bailed out of jail, a deputy from the Hillsborough County Sheriff’s Office tracked him down, handed him the warrants and demanded the phone passcodes. Again, Montanez refused. Prosecutors went to a judge, who ordered him locked up again for contempt of court.

“I felt like they were violating me. They can’t do that,” Montanez, 25, recalled recently. "F--- y’all. I ain’t done nothing wrong. They wanted to get in the phone for what?”

William Montanez
William MontanezCourtesy of William Montanez

He paid a steep price, spending 44 days behind bars before the THC and gun charges were dropped, the contempt order got tossed and he pleaded guilty to a misdemeanor pot charge. And yet he regrets nothing, because he now sees his defiance as taking a stand against the abuse of his rights.

“The world should know that what they’re doing out here is crazy,” Montanez said. The police never got into his phones.

While few would choose jail, Montanez’s decision reflects a growing resistance to law enforcement’s power to peer into Americans’ digital lives. The main portals into that activity are cellphones, which are protected from prying eyes by encryption, with passcodes the only way in.

As police now routinely seek access to people’s cellphones, privacy advocates see a dangerous erosion of Americans’ rights, with courts scrambling to keep up.

“It’s becoming harder to escape the reach of police using technology that didn’t exist before,” said Riana Pfefferkorn, the associate director of surveillance and cybersecurity at the Center for Internet and Society at Stanford Law School. “And now we are in the position of trying to walk that back and stem the tide.”

While courts have determined that police need a warrant to search a cellphone, the question of whether police can force someone to share a passcode is far from settled, with no laws on the books and a confusing patchwork of differing judicial decisions. Last month, the Indiana Supreme Court heard arguments on the issue. The state supreme courts in Pennsylvania and New Jersey are considering similar cases.

As this legal battle unfolds, police keep pursuing new ways of breaking into cellphones if the owners don’t cooperate — or are enlisting help from technology firms that can do it for them. This has put them at odds with cellphone makers, all of whom continually update their products to make them harder for hackers or anyone else to break into.

But the hacking techniques are imperfect and expensive, and not all law enforcement agencies have them. That is why officials say compelling suspects to unlock their cellphones is essential to police work. Making the tactic more difficult, they say, would tilt justice in favor of criminals.

“It would have an extreme chilling effect on our ability to thoroughly investigate and bring many, many cases, including violent offenses,” said Hillar Moore, the district attorney in East Baton Rouge, Louisiana, who got the FBI’s help in breaking into a cellphone belonging to a suspect in a deadly Louisiana State University fraternity hazing ritual. “It would basically shut the door.”

Clashes over passcodes

In the part of Florida where Montanez lives, authorities are guided by a case involving an upskirt photo.

A young mother shopping at a Target store in Sarasota in July 2014 noticed a man taking a picture of her with his phone while crouching on the floor. She confronted him. He fled. Two days later, police arrested Aaron Stahl and charged him with video voyeurism.

Authorities got a search warrant for Stahl’s iPhone, but he wouldn’t give them the passcode, citing his Fifth Amendment right not to incriminate himself. A trial judge ruled in his favor, but a state appellate court reversed the decision in December 2016, saying Stahl had to provide the code. Facing the possibility of getting convicted at trial and sentenced to prison, Stahl agreed to plead no contest in exchange for probation.

While Stahl did not provide the passcode in the end, prosecutors still rely on the precedent established by the appellate ruling to compel others to turn over their passcodes under the threat of jail.

“Up until that point you could be a pedophile or a child pornogropher and carry around the fruits of your crime in front of law enforcement officers, prosecutors and judges and taunt them with fact that they couldn’t get the passcode,” said Cynthia Meiners, who prosecuted Stahl at the 12th Judicial Circuit State’s Attorney’s Office. “You could say, ‘I’m a child pornographer and it’s on my phone but I’m not giving you my passcode because I would be incriminating myself.’”

But that ruling only holds in a few counties of Florida. Elsewhere in the country, skirmishes remain unresolved.

In Indiana, police officials are trying to force a woman to share her passcode as they investigate her for harassment, saying she was making it impossible for them to obtain key evidence. The woman’s lawyer says authorities haven’t said what evidence they think is in the phone, raising concerns about a limitless search.

Her appeals reached the state Supreme Court, whose ruling could influence similar cases around the country. Attorneys general in eight other states filed a brief in support of the police, warning against a ruling that “drastically alters the balance of power between investigators and criminals.”

The stakes are similar in New Jersey, where a sheriff’s deputy accused of tipping off drug dealers to police activities has refused to hand over passcodes to his iPhones. The state Supreme Court agreed in May to hear the case.

These clashes aren’t limited to the use of passcodes. Police have also tried to force people to open phones through biometrics, such as thumbprints or facial recognition. Legal experts see the Fifth Amendment argument against self-incrimination as more of a stretch in those cases. The law has generally been interpreted as protecting data that someone possesses — including the contents of their mind, such as passcodes — but not necessarily their physical traits, such as thumbprints. Still, some judges have refused to sign warrants seeking permission to force someone to unlock their phone using their face or finger.

The rules on compelled decryption are more lenient at the U.S. border, where federal agents have given themselves wide authority to search the phones of people entering the country ─ and have reportedly spent hundreds of thousands of dollars on third-party hacking tools.

“Depending on where you are in the country, there is different case law on what police can do,” said Andrew Crocker, a senior staff attorney at the Electronic Frontier Foundation, a civil liberties nonprofit.

In some states, there is no authoritative court ruling, leaving law enforcement authorities to decide for themselves. Virginia falls into that category. Bryan Porter, the prosecutor in the city of Alexandria, said he has told local police it’s OK to try to force someone under the threat of jail to open a cellphone by thumbprint or face. But demanding a password seems to go too far, he said.

Criminals shouldn’t be able to inoculate themselves from investigations, Porter said. “But it kind of rubs me the wrong way to present a piece of paper to someone and say, ‘Give us your passcode.’”

‘What they were doing to me was illegal’

In Tampa, Florida, where Montanez was arrested last year, judges still rely on the 2016 ruling against Stahl by the Second District Court of Appeals. That is what prosecutors cited when they tried to force Montanez to give up his passcodes.

But Montanez’s lawyer, Patrick Leduc, argued that, unlike Stahl’s case, police had no reason to search the phone, because it had no connection to the offenses he was charged with. The “OMG, did they find it?” text message — which turned out to be from Montanez’s mother, who owned the car and the gun in the glove box — was meaningless, Leduc said. He warned of a police “fishing expedition” in which authorities could search for anything potentially incriminating on his phone.

While sitting in lockup for contempt, Montanez’s resolve not to give up his passcodes hardened. “What they were doing to me was illegal and I wasn’t going to give them their business like that,” he said.

“They told me I got the key to my freedom,” he added. “But I was like, ‘F--- that.’”

But the experience shook him. “I ain’t the toughest guy in the world, but I can protect myself. But it was crazy,” he said. “Bad food, fights here and there, people trying to take your food.”

At the same time, the drugs and gun case against Montanez was crumbling. Laboratory tests on the suspected THC oil came back negative, voiding that felony charge and the gun charge related to it. That left prosecutors with only minor pot charges. But he remained in jail on the contempt charge while his lawyer and prosecutors negotiated a plea deal.

In August 2018, after Montanez had spent more than five weeks in jail for refusing to provide the passcode, an appellate court dismissed the contempt case on a technicality. The court invited prosecutors to try again, but by then the passcode’s value had diminished. Instead, prosecutors allowed Montanez to plead no contest to misdemeanor drug charges and he was freed.

When he was released, Montanez carried a notoriety that made him feel unwelcome in his own neighborhood. He noticed people looking at him differently. He was banned from his favorite bar.

The police keep pulling him over, and he now fears them, he said. He finally left Tampa and lives in Pasco County, about an hour away.

“Yeah, I took a stand against them,” he said. “But I lost all that time. I gotta deal with that, going to jail for no reason.”