The telltale mobile phone: Keeping your data safe when reporting from the field

The 2024 U.S. presidential election has already been a magnet for protests, and covering any kind of protests is high risk for journalists. The U.S. Press Freedom Tracker covered demonstrations in advance of the presidential debate in September and during the Democratic National Convention in Chicago, Illinois, in August, at which journalists present on the ground were subject to arrest and, in some cases, had their equipment confiscated or damaged.

David Huerta, Martin Shelton, and Davis Erin Anderson of the Digital Security Team at Freedom of the Press Foundation (FPF) sat down with FPF’s Senior Adviser Caitlin Vogus to discuss journalists’ constitutional rights in the event of device seizure, and what they can do now to plan ahead for reporting from the field.

This is Part 3 of our series of conversations about journalism, digital security, and the 2024 U.S. election. Read Part 1 and Part 2.

Davis Erin Anderson, senior digital security trainer: With just days to go until Election Day, the 2024 U.S. presidential race has already been a magnet for protests. Given the likelihood that public demonstrations will continue in the months ahead, and that journalists will be on hand to cover them, I thought we should talk through our legal rights around device seizure. When you think back on this year, I wonder if any specific cases come to mind that can provide context for these issues.

Caitlin Vogus, senior adviser: It’s not uncommon for police to seize cellphones and other equipment from journalists who are covering protests. The U.S. Press Freedom Tracker has documented at least 49 cases of equipment searches and seizures targeting journalists covering protests, and many of those have happened in the last year.

One case that I want to highlight is the case of Dilan Gohill. He is a student journalist at Stanford for The Stanford Daily, and he was arrested last June while he was covering a student protest on campus. It was a pro-Palestinian protest in which protesters broke into a campus building and barricaded themselves inside, and Dilan, in his capacity as a reporter, was with them to report on what was happening. When police came to clear out the building, they arrested him along with the protesters, despite the fact that he identified himself as a journalist, he was wearing a Stanford Daily sweatshirt, and he was reporting the news. They held him in jail for fifteen hours and booked him on felony charges that remain pending — those charges haven’t been dropped.

I think one of the most disturbing aspects is that, according to a press release from Dilan’s lawyers, sheriff’s deputies tried to unlock his phone while he was in jail by putting it up to his face so they could use Face ID. Dilan was able to look away and dodge the attempt to unlock the phone, so they weren’t able to get into his device. But I’d say this is a really disturbing incident. It doesn’t even seem like there was any justification at all to search his device in the first place, let alone try to use his face to unlock it.

Martin Shelton, deputy director of digital security: In 2020, another election year, a journalist with Full Revolution Media was arrested on the night of Sept. 26 in Portland, Oregon, when he was covering a protest of the killing of George Floyd in Minneapolis. During this arrest, the journalist was carrying a lot of different types of equipment: a battery, protective equipment, cameras, cellphones. For me as a security trainer, this is making me think about what’s in that camera, what is in that cellphone. There are also a number of other things here that just get damaged along the way. We also see no shortage of times when police in the course of making this kind of seizure might drop a camera, sometimes breaking the camera, and this can be really expensive and inconvenient, even if you don’t actually experience a search of that device. There’s a whole cascade of things that can go wrong here.

Anderson: What is at stake when a journalist has their devices? What sorts of information is available to the police through one’s phone, for example, out of all the devices that we’re carrying?

David Huerta, senior digital security trainer: Our smartphones are, in many ways, an extension of our brains. If you really think about what is on your smartphone, the simplest answer is: everything. Think about your contacts, your records of contact with your contacts. Think about the messages that you’ve sent to contacts in every single app and platform that you have installed on your phone. Think about the fact that you have what is essentially a tracking beacon in the form of a cellphone that has the ability to allow certain apps location access, potentially, if you’ve opted in for that. That’s basically the answer: If you can think of something about yourself, some evidence of that exists in there. If you can think about some interaction that you’ve had with your sources at any point, some evidence of that probably exists in your smartphone.

Anderson: This brings us back to Caitlin’s example of the journalist who had their phone held up to their face. Caitlin, was that legal? Relatedly, would Face Unlock be treated differently from being compelled to hand over your passcode?

Vogus: When we’re talking about police access to a journalist’s device, like a cellphone, and the question of using biometric data to unlock it, there are actually two important constitutional rights that we need to think about. The first is the Fourth Amendment, which protects people from unreasonable searches and seizures and generally requires police to have a warrant to conduct a search on something like a digital device. The threshold question in the Stanford case that I talked about earlier is, under the Fourth Amendment, did police have the probable cause to search a cellphone in the first place (setting aside the question of the Face ID)? And I think pretty clearly, no, they didn’t. From everything we know, there’s been no justification given for a reason they would need to search his device, and they certainly didn’t have a warrant at that point.

There are exceptions to the Fourth Amendment warrant requirement. One that often comes up in the context of journalists being arrested at protests is called the “search incident to arrest” exception. The Supreme Court has said that when police officers arrest someone, they can also search that person and the area around that person. There are two reasons for that. One is about officer safety, to make sure that the person isn’t carrying a weapon, and the second is about preservation of evidence. We used to see police claim this search incident to arrest exception as a basis for searching people’s cellphones when they made an arrest. But what happened is, the Supreme Court considered that question in a case called Riley v. California, and the court recognized the vast amount of private information that people store on their cellphones, like David was talking about. It said that the search incident to arrest exception doesn’t apply to a search of digital information on a cellphone. The search incident to arrest exception didn’t apply in Dilan’s case at Stanford.

Then we come to the question: Do police have the right to search the phone? Say, for example, police have a search warrant for a journalist’s phone, but the phone is locked. Do they have the right to compel the journalist to turn over whatever it is that would unlock the phone, whether that’s a passcode or biometric information like a Face ID or fingerprint or something like that? That’s a question that comes up under the Fifth Amendment, which is about the right against self-incrimination. It says that a person can’t be forced to be a witness against themselves in a criminal case.

The Fifth Amendment only applies to what they call testimonial acts — those that disclose information that’s in a person’s mind. By contrast, something that is nontestimonial is not protected by the Fifth Amendment. To give an example: Standing in a lineup or being fingerprinted by police are both considered nontestimonial acts.

And so then the question becomes, is requiring someone to give their password for their phone a testimonial act covered by the Fifth Amendment? Or is this a nontestimonial act? And here, courts are somewhat divided. The way most courts have come down is that requiring a person to provide their passcode is a testimonial act, and it’s covered by the Fifth Amendment. That means the police cannot compel you to give your password to your phone. On the other hand, requiring someone to use their biometrics data like their face or their fingerprint to unlock their phone, courts have said that’s not testimonial. It doesn’t reveal anything about the contents of a person’s mind, and so you can be compelled to unlock your device with biometrics. For journalists, from a legal perspective, it’s much safer to actually use a passcode to lock your phone than it is to use something like Face ID or your fingerprint.

Anderson: Thank you for explaining that so clearly, Caitlin. It’s important, I think, to remember that protests are taking place in public spaces that are replete with surveillance cameras, both publicly and privately owned. So, if you’re typing in a passcode onto your phone, you can easily be caught on camera. Does this count as evidence? Can those passwords that are caught on camera be used to unlock a device? How does this complicate matters legally?

Vogus: From a legal perspective, I’m not aware of any case that’s considered this exact question. And, you know, the way that we develop our law in this country is through case law, as we hear judges consider these kinds of things.

I don’t know that we have an exact answer, but thinking about it as a legal matter, the threshold question I would be thinking about is whether using a surveillance camera to glean someone’s password would be considered a search under the Fourth Amendment, which would mean a warrant would be required. And whether or not something is a search under the Fourth Amendment depends on whether the person has a reasonable expectation of privacy. And you may say, “OK, well, if it’s a surveillance camera in public, you’re in public, so you don’t have any reasonable expectation of privacy in public.” That would be one argument.

Meanwhile, the court has recognized some expectation of privacy even in public. For example, in the Carpenter case, the Supreme Court said that persistent tracking of people’s locations through their cellphones counts as search under the Fourth Amendment, and that people have a reasonable expectation of privacy. Arguably, you have a reasonable expectation of privacy in your password, even if you’re entering it in public. My advice for journalists is to make certain you’re acting in a way that makes clear that putting in your password is private by not saying it out loud, shielding your phone with your body a little bit. You’re making it private, even if you’re in public, if you’re really worried about that scenario.

Shelton: We are absolutely surrounded by phones that are right next to us as well. So that’s making me think about the trolls who might be at the protest, the people who might have a problem with the press and their presence at an event. You may be deliberately recorded by somebody who wants to harass you. That is also a serious issue, especially given that at some of the rallies that we’ve been seeing in recent months, the press will be explicitly called out, named, and shamed, and that escalates the risk to people who are in attendance at these events — not only of potential surveillance but also of violence.

Huerta: Further to Martin’s point, out and about in my neighborhood, for example, are essentially all Ring cameras that are piping video feeds into Amazon servers. Ring has a history of cooperating with law enforcement and giving them video recordings. And that may be something to consider in the equation, that it may not necessarily even need a subpoena, that it could just be that law enforcement could knock on the proverbial door of Jeff Bezos and then get the footage that they want without asking a court.

If you’re reading this and would like to opt out of unwittingly providing surveillance footage, there are alternatives to things like Ring. Apple’s HomeKit Secure Video allows for surveillance cameras that are end-to-end encrypted from the feed to whatever Apple device you’re using to actually view them, and that protects the privacy of everyone involved.

Anderson: This is actually quite a complicated landscape. What can we tease out in terms of advice for people who are heading into the world with all these cameras around, with the protections that we do and do not have at present?

Shelton: We often talk to journalists about the trade-off between some of those protections under the Fourth and Fifth amendments. If you are in that room surrounded by cameras, it might actually be to your benefit to use Face Unlock or to unlock with a fingerprint. But if the concern is that you’re at risk of arrest, then that’s when everything changes. That’s when we want to think about how somebody would be able to get access to that phone. Actively turning off the device is probably the safest thing to do, because as soon as we enter our passwords, we have now decrypted the phone, and it becomes a lot easier to take information off of that device.

Vogus: We’ve been talking about risk models around authorities having access to your physical device. But journalists should also keep in mind that law enforcement doesn’t necessarily need access to your device in order to obtain information about, for example, your communications. They can get legal orders that can go directly to your service providers and get information about, for example, who you’re talking to, or your web traffic, or what images you’re storing.

Huerta: To Caitlin’s point, Apple’s Advanced Data Protection helps protect you from this particular scenario. If you’re using iCloud with your Apple devices, you have the ability to enable that feature. When that legal request does go to Apple, certain types of data — for example, your notes, your iMessage content — would be end-to-end encrypted, so that Apple is not actually able to hand over those records. This feature is incredibly useful and powerful. I would recommend turning that on.

Shelton: We train journalists on the practice of preparing a secondary device to bring into the field so that you have only what you need for the purposes of covering an event. So this would be things like your lawyer’s number, the number of your editor, any of the relevant apps that you might need in order to communicate with folks. We talk about Signal as a possible tool that could be useful to bring into the field for encrypted messaging with any of your colleagues. If it’s possible to have that secondary device, we also generally recommend going with one that’s on the newer end so that it’s still receiving security updates.

We’ve begun to see some reporting from 404 Media about the most recent versions of police cracking software, things like Cellebrite — these little boxes that will try to break into your device. What we’re seeing is that the newest Pixel and iPhone devices are fairly resistant to these types of attacks. It’s not impossible to get in, but having a new and up-to-date phone definitely does make it significantly more expensive for police cracking devices to work.

Vogus: My advice is to do a personal risk assessment in the moment. Try to figure out whether speaking up will risk escalating a situation with police and put you in greater danger. If you’re in the position to push back a little bit, make sure that the police know you are a journalist. You can say, “I’m a journalist,” “I’m a member of the press,” “I am not a protester,” “I’m here as a journalist.” It can be a good idea to have a press pass or press credential that you can show to police, and if you don’t work for a news organization that issues one — if you’re a freelancer, for example — you might be able to get one from your local press association or from an organization like the National Press Photographers Association.

If the police arrest you, they can take your device, and you should comply with giving them your device. If they’ve arrested you, state that you don’t consent to any search of your device. You may also want to let police know about a law that’s called the Privacy Protection Act of 1980. This is an important law for journalists that says that police cannot search or seize devices and other things used in the newsgathering process unless there’s probable cause to believe that someone has committed a crime totally unrelated to newsgathering. Read up about your state shield law and be able to talk about that as well.

And then Martin already mentioned this, but it can be a good idea to have a lawyer’s phone number on hand, perhaps literally on hand, like written on your body. And if you don’t have your own personal lawyer, there is a legal hotline run by the Reporters Committee for Freedom of the Press that also answers calls from journalists who have been arrested, and that can be a good number to have.