Forced biometric authentication in Norway
On 5 April 2017, the Norwegian Government proposed an amendment to the Norwegian code of criminal proceedings to allow the police to compel the use of biometric authentication. After two quick debates, the Norwegian Parliament passed the proposition into law on 21 June.
Article 199 of the Norwegian code of criminal proceedings reads as follows after the change:
When searching an electronic system the police can demand from anyone with connection to the system the necessary information to gain access to the system or open it by biometric authentication.
If anyone refuses a demand for biometric authentication as proposed in the first sentence, the police may perform the authentication by force.
The decision to use force by the second sentence is decided by the prosecutors office. If there is any risk by delaying, The decision can be made by the police on the spot. The decision shall immediately be reported to the prosecutors office.
[…]
The lack of specificity of an “electronic system” means this law has an extremely wide scope. We can, for example, envision that access to a personal device such as a mobile phone, which stores the access credentials to several cloud storage services, essentially gives away a more or less complete description of a person's life. To entrust such decision to a single police officer with no due process means that an act with very far reaching consequences may be performed in a matter of seconds. EFN is exploring the possibility that this may violate the privacy protections afforded by Article 8 of the European Convention on Human Rights (ECHR) and possibility the right to avoid self incrimination afforded by Article 6.
There is also no reference to proportionality of the use of force. Although there is no reason to suspect this would be used in a disproportionate way, the lack of such a limitation means that we don't know how far the use force might be taken. While the use of torture is prohibited by the Norwegian constitution, such lack of specificity in an individual law risks creating a situation where an overzealous officer may deem it necessary to perform acts which are prohibited by other parts of the law. It is not obvious how the law may be applied for example when iris scanning is involved. Logically, force must be applied in close proximity to the eyeball and eye socket, which puts an individual at obvious physical risk.
There is also no reference to proportionality of the use of force. Although there is no reason to suspect this would be used in a disproportionate way, the lack of such a limitation means that we don't know how far the use force might be taken. While the use of torture is prohibited by the Norwegian constitution, such lack of specificity in an individual law risks creating a situation where an overzealous officer may deem it necessary to perform acts which are prohibited by other parts of the law. It is not obvious how the law may be applied for example when iris scanning is involved. Logically, force must be applied in close proximity to the eyeball and eye socket, which puts an individual at obvious physical risk.
It is also also important to take note that the law is not limited to suspects but “anyone with connection to the system”. This means that someone with no connection to a crime may be subjected to the above mentioned uses of force.
EFN is worried about the development this and other changes of the law in the same direction represents. This law has been rushed through without proper justification, and the wording has been chosen with apparently little or no regard to proper scope.