With phones becoming treasure troves of personal and potentially incriminating data, a pressing legal question arises: Can the police force an individual to unlock their phone during an investigation?
NEW DELHI: While the legal framework on phone seizure is reasonably clear—requiring either a warrant or due process—the question of whether an individual can be forced to unlock their device remains legally murky in India. This complexity hinges significantly on how the phone is locked: via passwords or patterns, or through biometric methods like fingerprint or face recognition.
In one instance, the Karnataka High Court ruled that
“individuals do not have the right to withhold their phone passcodes from the police”
This ruling emerged from a narcotics case where the accused, a Bengaluru-based tech professional, refused to share passwords for his phone and email accounts. The High Court observed that recognizing such a right would hamper law enforcement operations and declared that suspects must cooperate when officers seek access to digital evidence.
CBI Court in Delhi: Password Disclosure Violates Constitutional Rights
Contrasting sharply with the Karnataka ruling, a Special CBI Court in New Delhi held that suspects cannot be compelled to divulge their phone passwords—whether by the police or even the judiciary. The court based its judgment on two constitutional guarantees:
- Right to Privacy (recognized as a fundamental right by the Supreme Court in Justice K.S. Puttaswamy v. Union of India)
- Right Against Self-Incrimination, enshrined under Article 20(3) of the Indian Constitution, which asserts that “no person accused of any offence shall be compelled to be a witness against himself.”
The court noted that remembering and typing a password involves personal mental faculties, making it a form of testimonial evidence—thus protected by the Constitution.
Biometrics vs. Passcodes: A Legal Distinction
In a nuanced take, the CBI court drew a clear distinction between passcodes and biometrics:
- Passwords/Patterns: Require mental effort and personal knowledge—therefore, compelling their disclosure amounts to testimonial compulsion and violates Article 20(3).
- Biometrics (fingerprints, facial or iris recognition): Considered physical evidence rather than testimonial. Hence, suspects can be compelled to use biometrics to unlock devices.
This interpretation means that your right to remain silent applies to passwords, but not to your fingerprints or facial ID.
ALSO READ: Waqf (Amendment) Act, 2025 | “No Decision Without Hearing Us”: Centre Files Caveat in SC
A Legal Grey Zone: Courts in Conflict
The conflicting judgments between the Karnataka High Court and the CBI court highlight the lack of clarity and uniformity in Indian law regarding digital privacy and investigative powers. While the CBI court respectfully disagreed with the Karnataka High Court’s stance—calling it “not correct” and even per incuriam (decided without regard to binding precedent)—such a declaration is controversial. After all, a special court does not hold precedence over a High Court, making this contradiction jurisprudentially questionable.
The disagreement also underscores the Indian judiciary’s struggle to keep up with evolving technology, especially where fundamental rights intersect with digital surveillance.
Self-Incrimination in India: A Legal Perspective
Under Indian jurisprudence, the right against self-incrimination protects individuals from being forced to provide evidence that could link them to the commission of a crime. The scope of this protection was addressed in the landmark case Bombay v. Kothi Kalu Oghad (1961), where the Supreme Court considered whether compelling an accused to provide handwriting, signature, or thumb impression samples violated Article 20(3) of the Indian Constitution.
The Court ruled against the accused, explaining that evidence could be either testimonial or non-testimonial. It clarified that only testimonial evidence, which reveals personal knowledge, could lead to self-incrimination. Non-testimonial evidence, such as handwriting, does not inherently reveal personal knowledge or incriminate the individual but could serve as a tool for corroborating or comparing other evidence. Hence, the Court held that an accused can be compelled to provide handwriting samples without violating the right against self-incrimination.
This ruling has been applied in subsequent cases where individuals have been compelled to provide other non-testimonial samples like thumb impressions, breath samples, voice recordings, and even DNA. However, in Selvi v. State of Karnataka, the Supreme Court further solidified the protection against self-incrimination by declaring certain investigative techniques, such as brain mapping, narco-analysis, and lie detector tests, unconstitutional.
The Court emphasized that these methods invade an individual’s mental privacy and may extract involuntary confessions, thus violating Article 20(3) which guarantees the right to privacy.
This legal framework ensures that any information directly arising from an individual’s personal knowledge is shielded from compulsory disclosure, a principle also upheld by U.S. law. However, the application of this principle regarding the compulsion to unlock digital devices, such as the use of passcodes, remains unresolved in India.
Passcode and Self-Incrimination in the United States
In the United States, the issue of whether forcing an individual to provide a mobile passcode or fingerprint violates the Fifth Amendment’s protection against self-incrimination has yet to be definitively settled by the U.S. Supreme Court. However, state courts have delivered conflicting rulings on the matter.
In one case, the Pennsylvania Supreme Court ruled that an accused cannot be compelled to reveal the passcode to a computer, as the password exists solely in the mind of the individual. This decision was based on the notion that compelling someone to disclose their passcode is akin to forcing them to reveal their thoughts, which is prohibited by the Fifth Amendment.
On the other hand, some courts have allowed the forced disclosure of a passcode by applying the “foregone conclusion” doctrine. This doctrine permits the compulsion of evidence if the prosecution can demonstrate that it already knows the contents of the device and that the passcode will not provide any new information. For instance, a court may require a passcode if it can prove that the device belongs to the accused, the accused knows the passcode, and the contents of the device are already known.
In certain instances, courts have applied this doctrine to demonstrate the accused’s knowledge of the passcode. In Missouri v. Jones, the court allowed the production of the passcode because the accused had previously unlocked the phone, and this act was deemed to confirm the accused’s knowledge of the passcode, thus satisfying the foregone conclusion test.
The legal landscape surrounding the compelled production of fingerprints is similarly divided. Some courts, like the one in Commonwealth v. Baust, have permitted the production of fingerprints for decryption purposes, arguing that fingerprints are non-testimonial physical evidence. In contrast, other courts have considered fingerprints to be the “functional equivalent” of passcodes, especially when used to unlock digital devices, and thus have prohibited their compulsory production.
These conflicting rulings in the U.S. create ambiguity regarding the compelled production of passcodes and fingerprints. As such, the Indian legal system would benefit from clarity on this issue, particularly in light of the growing reliance on digital evidence.
Global Parallels and the Path Forward
This debate is not unique to India. Similar controversies have unfolded globally:
- In the U.S., the Apple vs. FBI encryption case triggered a nationwide conversation on privacy versus public safety.
- The EU has also faced complex cases related to encrypted communications platforms like EnconChat.
Meanwhile, in India, a group of journalists has filed a writ petition before the Supreme Court seeking clarification on this very issue.
ALSO READ: Waqf Act 2025 Explained: Why Converts Must Be Muslims for 5 Years to Make Waqf Donations
What Should You Do If Asked to Unlock Your Phone?
Until the Supreme Court settles the matter, there is no clear legal rule about whether police can make you unlock your phone—and if so, under what conditions. If confronted with such a request, it is advisable to:
- Stay calm and cooperative, but
- Consult a lawyer immediately before disclosing any passcode or unlocking your phone, especially if it could incriminate you.
As India continues to digitize, the legal system must evolve to safeguard both individual rights and the state’s investigative interests in a balanced, consistent, and constitutionally sound manner.
READ MORE REPORTS ON SUPREME COURT
FOR MORE LEGAL UPDATES FOLLOW US ON YOUTUBE
