Should I ask the user for the passcode?¶
Only when there is a defined lawful and operational reason to do so.
Obtaining a passcode and having authority to examine the phone are separate questions.
Access and examination are not the same thing¶
A passcode may provide technical access.
It does not automatically establish:
- consent;
- authority to search;
- scope of examination; or
- permission to use every account or application on the device.
Those questions depend on the applicable legal and organisational process.
The request can itself affect the investigation¶
Asking may:
- alert the person;
- change their behaviour;
- prompt remote action through another device; or
- affect later accounts of consent or cooperation.
If the phone is already unlocked, do not ask for a passcode simply from habit.
Preserve the current state and decide what the actual objective is.
Record the request precisely¶
If a request is made, record:
Avoid repeated attempts, improvised pressure or asking the person to navigate through content unless that separate action is also justified.
What should be recorded if a passcode is supplied? covers the next step.
The practical point is: ask for a passcode only for a defined purpose and keep technical access separate from authority to examine content.
