More than a decade ago, the keynote speaker at a major annual cybersecurity conference strode into the spotlight and predicted the death of the password. “They just don’t meet the challenge for anything you really want to secure,” he told the audience of computer experts in San Francisco. The speaker was Bill Gates, the preeminent cyber-prophet of the day, but his forecast has not yet come true.

We’ve certainly gotten closer to the password’s demise. Millions of people use their fingerprints to unlock their smartphones every day, and tech companies are experimenting with new security features that rely on biometrics like user’s speech habits or iris patterns. The next frontier—devices that can detect an authorized user based solely on the quirks of how they interact with it—is just around the bend.

…
But these decisions don’t necessarily mean the debate over the Fifth Amendment and fingerprint readers is all wrapped up, says Al Gidari, a technology lawyer and the director of privacy at Stanford University’s Center for Internet and Society.

Gidari disagrees with the judges who signed warrants for fingerprint unlocks. The Supreme Court has determined that the Fifth Amendment applies only to “testimonial communication that is incriminating.” Gidari says that even though a fingerprint on its own isn’t covered by the Fifth Amendment, the act of unlocking a device with a fingerprint falls into the special protected category.

“When you put your fingerprint on the phone, you’re actually communicating something,” Gidari said. “You’re saying, ‘Hi, it’s me. Please open up.’”

The same should hold true for any other biometric authentication, Gidari said, whether it’s a physical feature like an iris pattern, a unique characteristic like a speech pattern, or a behavioral trait like a typing or clicking pattern. Any action or characteristic that’s programmed to unlock a phone becomes a way of communicating and should be protected, he said.