Your Phone, Your Password, and Article 35(4): Can You Be Forced to Unlock It?

Imagine this. A man is picked up in connection with a case. His phone is seized along with everything else in his pockets. At the police station, an officer places the phone in front of him and asks for the password.

He does not want to give it. Not because the phone contains evidence of a crime, but because it contains eight years of his life — his messages, his photographs, his banking apps, his medical reports, conversations with his lawyer.

Does he have to give it?

Most people assume the answer is obvious. It is not. In Bangladesh, this question has almost no clear answer, and that is exactly why it deserves attention.

What Article 35(4) actually says

Article 35(4) of the Constitution is one short sentence:

This is the constitutional right against self-incrimination. It is a very old idea, and the reason behind it is simple. If the State wants to punish a person, the State must prove its own case. It cannot take a shortcut by turning the accused into the main source of evidence against himself. Once that shortcut is allowed, the temptation to obtain "cooperation" through pressure becomes very hard to resist.

Our ordinary law reinforces the same principle in several places. Under the Code of Criminal Procedure, a person being examined by the police is not bound to answer questions that would expose him to a criminal charge. Confessions made to a police officer are not admissible in evidence, and a confession made in police custody is generally inadmissible unless recorded by a Magistrate with proper safeguards. The Evidence Act treats a confession as worthless if it was caused by inducement, threat or promise.

So the framework is clear enough — when the evidence is a statement.

Where the line has traditionally been drawn

Courts across this subcontinent have long distinguished between two very different things.

The first is testimonial evidence — evidence that comes out of a person's mind. A statement, an admission, an explanation, an answer to a question. This is protected.

The second is physical evidence taken from the body — fingerprints, a specimen signature, a handwriting sample, a blood or breath sample, standing in an identification parade. Courts have generally held that this is not protected, because the accused is not communicating anything. His body is simply being examined, the way a knife or a shirt would be examined.

Indian courts have developed this distinction extensively, and Bangladeshi courts have often found that reasoning persuasive. Indian authority has also gone a step further, holding that techniques which extract material from a person's mind against his will — polygraph tests, narco-analysis, brain mapping — do fall within the protection, because they reach into the mind itself.

Keep that line in view — mind versus body — because a modern smartphone sits precisely on top of it.

The password problem

A password is something you know. It exists only in your memory. Compelling you to reveal it is, at least on the face of it, compelling you to communicate the contents of your mind. That looks very much like testimonial evidence.

A fingerprint or a face scan is something you are. It is physical. On the traditional test, it looks like the identification parade or the handwriting sample — outside the protection.

The result is a strange and slightly absurd position. Two people are arrested in identical circumstances. One has a six-digit PIN. The other has fingerprint unlock enabled. On the traditional analysis, the first man may be constitutionally protected and the second man may not be — even though the thing being unlocked, and the harm to his privacy, is exactly the same.

Courts in other countries have already noticed this problem and are moving away from a purely mechanical mind-versus-body test. Some have asked a better question: what does the act of unlocking actually tell the State? Even producing an unlocked phone communicates something — that the phone is yours, that you control it, that you know the password. That is an admission, and it can be a decisive one.

What our law currently allows — and what it does not say

Three things need to be kept separate, because they are constantly confused.

Seizing the device. The police have clear statutory powers to search an arrested person, and to seize property connected with an offence under the ordinary provisions of the Code of Criminal Procedure. Our cyber security legislation — the line running from the Digital Security Act, 2018 through the Cyber Security Act, 2023 to the Cyber Security Ordinance, 2025 — also confers seizure powers on investigating officers in respect of computers and digital devices. That a phone may lawfully be seized in an appropriate case is not seriously in doubt.

Extracting data from a seized device. Whether the investigating agency can break into a device using forensic tools is a different question, and it is essentially a question of what powers the statute confers and what the warrant permits.

Compelling the accused himself to open it. This is the third and constitutionally hardest question, and it is the one on which we have almost nothing. There is, so far as I am aware, no clear reported decision of our Supreme Court squarely deciding whether a person accused of an offence can be compelled to disclose a password or to place his finger on a sensor.

That silence is not a small gap. It is a live question in police stations across the country every single day.

Three consequences worth understanding

One: seizure is not consent. The lawfulness of the seizure says nothing about whether the accused can be compelled to assist in unlocking. These are separate legal events, and they should be argued separately.

Two: our law does not have a strong exclusionary rule. In some jurisdictions, evidence obtained in breach of a constitutional right is automatically thrown out. That is not our general position. Evidence that is relevant has ordinarily been treated as admissible even where the method of collection was irregular, with the irregularity going to weight and credibility rather than to admissibility. This means a constitutional argument about how a phone was opened may not, by itself, keep the contents out of the record. The argument has to be constructed more carefully than that.

Three: refusal has practical consequences. A person who refuses to give a password should understand that investigators may treat the refusal as a reason to oppose bail, or invite the court to draw an unfavourable inference. Whether such an inference is constitutionally permissible is itself an open question — and a very good one to litigate.

What to do in practice

If your device is seized, ask for a proper seizure list recording the device, its condition, and whether it was powered on or off. Say clearly whether you are consenting or not — silence later gets described as cooperation. Do not sign a document you have not read. Contact a lawyer before answering questions about the device's contents.

If you are advising a client, keep three questions distinct: was the seizure lawful, was the extraction lawful, and was the accused compelled to assist. Preserve the objection on the record at the first opportunity, because an objection raised for the first time in appeal rarely succeeds. And remember that a phone almost always contains privileged lawyer–client communication — a protection that is worth asserting early and expressly.

The larger point

Our Constitution was drafted in a world where the most incriminating thing a person could carry was a letter in his pocket. Today the average citizen carries a device that knows more about him than his family does. Article 35(4) has not changed. What it must protect has changed completely.

That gap will eventually be filled — by legislation, or by a judgment in a case that nobody has yet brought. The people who shape that answer will be the ones who thought about the question early.