When objects betray you: the Internet of Things and the privilege against self-incrimination

ABSTRACT

The introduction of IoT data in court without the consideration of its impact on the privilege against self-incrimination leads to the restriction of this fundamental right of the accused, who sometimes has no real choice to decide for or against the use of their IoT data due to various economic, social and health reasons. This article presents the point of friction between digital evidence and the privilege against self-incrimination and its evolution over the years in Germany and the United States, highlighting the increasing introduction of IoT evidence in court. It then identifies the various reasons why IoT are adopted by users. Finally, this article emphasizes that technical solutions cannot fully contribute to the resolution of the conflict between the privilege against self-incrimination and the use of IoT data as evidence in court. A real solution to the problem can only be achieved by the legislature and corresponding adjustments to existing rules of criminal procedure.

KEYWORDS:

• privilege against self-incrimination
• Internet of Things
• wearables
• smart devices

Disclosure statement

No potential conflict of interest was reported by the authors.

Notes

1 Marie-Helen Maras, ‘The Internet of Things: Security and Privacy Implications.’ (2015) 5 (2) IDPL, 99.

2 COM (2018)0225 - C8-0155/2018-2018/0108 (COD), p. 11; Aude Géry and Florian Nicolai, ‘Law Enforcement and Access to Transborder Evidence: the Quest for the Exercise of Digital Sovereignty?’, in Glasze and others (eds.), Contested Spatialities of Digital Sovereignty, Geopolitics (Routledge Taylor & Francis Group, 2023) 28 (2) Geopolitical Forum, 919, 941.

3 This observation of the lack of consideration of criminal trial rights, particularly the privilege of self-incrimination was identified in Marie-Helen Maras and Adam Scott Wandt, ‘Case Commentary State of Ohio v. Ross Compton: Internet-Enabled Medical Device Data Introduced as Evidence of Arson and Insurance Fraud.’ (2020) 24(3) IJE & P 321.

4 US: 5th Amendment; France: Article préliminaire, Code de procedure penale; Germany: Sec. 136a German Criminal Procedural Code; Sweden: Chap. 36 sec. 6, Swedish Code of Judicial Procedure.

5 See Christoph Safferling and Alena Hartwig, ‘Das Recht zu schweigen und seine Konsequenzen‘ [2009] ZIS 784.

6 M.-H. Maras and A. S. Wandt, ‘Case Commentary State of Ohio v. Ross Compton: Internet-Enabled Medical Device Data Introduced as Evidence of Arson and Insurance Fraud.’ (2020) 24 IJE & P 321, 322

7 BGH (1954) 1 StR 578/53 (The Federal Court of Justice, Germany).

8 BGH (1954) 1 StR 578/53 (The Federal Court of Justice, Germany).

9 BVerfG (1981) 2 BvR 166/81 (German Constitutional Court).

10 BVerfG (1981) 2 BvR 166/81 (German Constitutional Court).

11 BGH (1998) 1 StR 156–98 (The Federal Court of Justice, Germany); BGH (2010) 1 StR 509/10 (The Federal Court of Justice, Germany)

12 Diemer,‘§136a‘, in: Christoph Barthe and Jan Gericke (eds.), Karlsruher Kommentar zur Strafprozessordnung (9th edn. C.H.Beck 2023) para 34; see also Michaela Wagner, Polygraphie im Strafverfahren? - Ein Plädoyer gegen die strafprozessuale Zulässigkeit des Lügendetektors (1st edn. Verlag Österreich 2012); Mark Schüssler, Polygraphie im deutschen Strafverfahren (1st edn. Peter Lang 2002).

13 United States v Williams 95 F 3d 723, 729–30 (8^th Cir 1996); Turner v Commonwealth of Virginia 685 SE 2d 665 (2009) (“polygraph examinations are so thoroughly unreliable as to be of no proper evidentiary use whether they favor the accused, implicate the accused, or are agreed to by both parties”).

14 E.g., United States v Johnson 446 F 3d 272 (2d Cir 2006); Asherman v Meachum 957 F 2d 978 (2d Cir 1992); United States v Lee 315 F 3d 206 (3d Cir 2003); United States v York 357 F 3d 14 (1st Cir 2004); Minnesota v Murphy 465 US 249 (1984).

15 United States v Von Behren 822 F 3d 1139 (10^th Cir 2016).

16 The Cornelian dilemma is a choice between options, each of which has detrimental effects.

17 ‘Polizei nutzt Corona-Kontaktdatenerfassung für Ermittlungen’ Stuttgarter Zeitung (Stuttgart 20 January 2021) <https://www.stuttgarter-zeitung.de/inhalt.luca-app-und-co-polizei-nutzt-corona-kontaktdaten-fuer-ermittlungen.66aae04d-f419-4fb5-8d56-5a5a97ed5b5d.html> accessed 09 April 2024.

18 Ibid.

19 Marco Gercke, ‘Die Bekämpfung der Internetkriminalität als Herausforderung für die Strafverfolgungsbehörden (2018) MMR 291, 298; Maik Bäumerich, ‘Verschlüsselte Smartphones als Herausforderung für die Strafverfolgung‘ (2017) NJW 2718. Wie deutsche Ermittler beschlagnahmte Smartphones knacken, Vice.com <https://www.vice.com/de/article/8qmxqx/wie-deutsche-ermittler-beschlagnahmte-smartphones-knackenittlerbeschlagnahmteSmartphonesknacken(vice.com)> accessed 15 May 2023.

20 Münchener Merkur, ‘Hussein K. länger am Tatort als erwartet‘, Münchener Merkur (München 8 January 2008) <https://www.merkur.de/welt/freiburger-mordprozess-handy-daten-belasten-angeklagten-zr-9506302.htmlHusseinK.längeramTatortalsvermutet> accessed 15 May 2023; ‘Wie Polizisten das Handy des Tatverdächtigen auslasen‘, Süddeutsche Zeitung (München 9 January 2018) <https://www.sueddeutsche.de/digital/prozess-wegen-vergewaltigung-und-mord-wie-polizisten-das-handy-des-freiburger-mordverdaechtigen-auslasen-1.3860870?reduced=true> accessed 15 May 2023. The case is also known as „Khavari-Case“.

21 Matt Burges ‘From Fitbits to PlayStations, the justice system is drowning in digital evidence.’ (Wired, 20 April 2018), <https://www.wired.co.uk/article/uk-police-courts-data-justice-trials-digital-evidence-rape-cases-cps> accessed 15 May 2023.

22 Ellen Nakashima ‘FBI paid professional hackers one-time fee to crack San Bernardino iPhone’ (The Washington Post, 12 April 2016) <https://www.washingtonpost.com/world/national-security/fbi-paid-professional-hackers-one-time-fee-to-crack-san-bernardino-iphone/2016/04/12/5397814a-00de-11e6-9d36-33d198ea26c5_story.html> accessed 15 May 2023.

23 Benjamin Derin and Tobias Singelnstein, ‘Verwendung und Verwertung von Daten aus massenhaften Eingriffen in informationstechnische Systeme aus dem Ausland (Encrochat)‘ (2021) NStZ 449.

24 Angelina Gebhard and Reinhart Michalke, ‘Der Zweck heiligt die Mittel nicht – Der EncroChat-Komplex und die Grenzen strafprozessualer Beweisverwertung‘ (2022) NJW 655.

25 Benjamin Derin and Tobias Singelnstein, ‘Verwendung und Verwertung von Daten aus massenhaften Eingriffen in informationstechnische Systeme aus dem Ausland (Encrochat)‘ (2021) NStZ 449, 450.

26 Angelina Gebhard and Reinhart Michalke, ‘Der Zweck heiligt die Mittel nicht – Der EncroChat-Komplex und die Grenzen strafprozessualer Beweisverwertung‘ [2022] Neue Juristische Wochenschrift 655, 656.

27 Bundeskriminalamt, ‘Kennzahlen zur Ermittlung des Bundeskriminalamts zur Auswertung der Encrochat-Daten in Deutschland im Jahr 2021‘ (2021), <https://de.statista.com/statistik/daten/studie/1249443/umfrage/encrochat-daten-ermittlungserfolge-des-bka/> accessed 15 May 2023.

28 OLG Karlsruhe (2021) 2 Ws 261/21 (Higher Regional Court of Karlsruhe); OLG Schleswig (2021) 2 Ws 47/21 (Higher Regional Court of Schleswig); OLG Bremen (2020) 1 Ws 166/20 (Higher Regional Court of Bremen); KG Berlin (2021) 2 Ws 79/21, 2 Ws 93/21 (Higher Regional Court of Berlin); OLG Celle (2021) 2 Ws 250/21 (Higher Regional Court of Celle); OLG Rostock (2021) 20 Ws 121/21 (Higher Regional Court of Rostock); HansOLG Hamburg (2021) 1 Ws 2/21 (Higher Regional Court of Hamburg).

29 OLG Rostock (2021) 20 Ws 121/21 (Higher Regional Court of Rostock).

30 OLG Rostock (2021) 20 Ws 121/21 (Higher Regional Court of Rostock).

31 BGH (2022) 5 StR 457/21 (The Federal Court of Justice, Germany).

32 Maik Bäumerich, ‘Verschlüsselte Smartphones als Herausforderung für die Strafverfolgung‘ (2017) NJW 2718; Marco Gercke, ‘Die Bekämpfung der Internetkriminalität als Herausforderung für die Strafverfolgungsbehörden (2018) MMR 291.

33 See on vein scans e.g. Stefan Krempl, ‘35C3: Mit Venenbild auf Handattrappe Geld abheben oder beim BND einbrechen (Heise, 28 December 2018) <https://www.heise.de/newsticker/meldung/35C3-Mit-Venenbild-auf-Handattrappe-Geld-abheben-oder-beim-BND-einbrechen-4259637.html> accessed 15 May 2023.

34 Christian Rottmeier and Philipp Eckel, ‘Die Entschlüsselung biometrisch gesicherter Daten im Strafverfahren‘ [2020] NStZ 193, 199.

35 BGH (2007) 3 StR 104/07 (The Federal Court of Justice, Germany); BGH (1986) 3 StR 551/85 (The Federal Court of Justice, Germany); see also Christian Rottmeier and Philipp Eckel, ‘Die Entschlüsselung biometrisch gesicherter Daten im Strafverfahren‘ (2020) NStZ 193.

36 See also Florian Nicolai, Das Internet der Dinge und das Strafrecht - Herausforderungen vernetzter Geräte für das materielle Strafrecht und das Strafprozessrecht (1st edn., Duncker & Humblot, in press) 356.

37 Christian Rottmeier and Philipp Eckel, ‘Die Entschlüsselung biometrisch gesicherter Daten im Strafverfahren‘ (2020) Neue Zeitschrift für Strafrecht 193.

38 LG Ravensburg (2023) 11 Gs 69/23 (Regional Court of Ravensburg).

39 LG Ravensburg (2023) 11 Gs 69/23 (Regional Court of Ravensburg).

40 Florian Nicolai, 'Freischaltung eines beschlagnahmten Mobiltelefons mittels Fingerabdruck', Case Commentary on LG Ravensburg (2023) 11 Gs 69/23 (Regional Court of Ravensburg) (2023) StV-Spezial , 148.

41 United States v Doe 487 US 201 (1987), at 212.

42 Doe v United States 487 US 201 (1988) (Stevens J, dissenting), at 219 (citing Boyd v United States 116 US 616 (1886), at 633-635); Fisher v. United States 425 US 391 (1976), at 420; see also United States v. Kirschner 823 F Supp 2d 665, (E D Mich 2010), at 669.

43 United States v Hubbell 530 US 27 (2000), at 44–5.

44 In re Grand Jury Subpoena (Boucher) No 2:06-mj-91, 2007 US Dist LEXIS 87951 (D Vt 2007), at 10.

45 Schmerber v California, 384 US 757 (1966), at 764.

46 Ibid, at 765.

47 Gilbert v California 388 US 263 (1967), at 266-7.

48 United States v Wade 388 US 218 (1967), at 221-2.

49 United States v Dionisio 410 US 1(1973), 6-7.

50 Holt v United States 218 US 245 (1910), at 252–3 (the accused putting on clothes for identification purposes was not considered communicative evidence and thus was not considered protected).

51 In Support of Search Warrant No. 2:18-mj-707 (2018) at 40 (accused compelled to place face in front of their iPhone to unlock their phone); In re A White Google Pixel 3XI 2019 US Dist LEXIS 83300 (D Idaho 2019) (case involving the use of a fingerprint to unlock smartphone).

52 e.g., In Matter of Search Warrant Application for [redacted text] 279 F Supp 3d 800 (N D Ill 2017) (the act of compelling the accused to place their finger on a smartphone’s Touch ID sensor is considered non-testimonial).

53 Commonwealth of Virginia v Baust 89 Va Cir 267 (2014).

54 Ibid at 271

55 890 N W 2d 143 (Minn Ct App 2017).

56 In Matter of Search of [Redacted] Washington, District of Columbia 317 F Supp 3d 523 (2018).

57 E.g., In re A White Google Pixel 3XI 2019 US Dist LEXIS 83300 (D Idaho 2019); In re Single-Family Home & Attached Garage US Dist LEXIS 170184 (N D Ill 2017).

58 In re Search of a Residence in Oakland 354 F Supp 3d 1010 (N D Cal 2019).

59 “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

60 i.e., the state can demonstrate that it already knows the information sought. The foregone conclusion requires the government to show with reasonable particularity that the accused knows the password of the phone, the documents sought by the government or on the phone, and the files are in the accused’s possession. See Fisher v United States 425 US 391 (1976).

61 In re Search of a Residence in Oakland 354 F Supp 3d 1010 (N D Cal 2019).

62 Katelin Eunjoo Seo v State of Indiana 148 N E 3d 952 (2020).

63 Ibid.

64 Ibid.

65 Ibid, at 955.

66 In re Search of a Residence in Oakland 354 F Supp 3d 1010 (N D Cal 2019).

67 Most recently: LG Ravensburg (2023)– 11 Gs 69/23 (Regional Court of Ravensburg).

68 IoT data is stored on the device, its associated app, or the cloud. See M.-H. Maras and A. S. Wandt, ‘Enabling Mass Surveillance: Data Aggregation in the Age of Big Data and the Internet of Things’ (2019) 4(2), Journal of Cyber Policy, 160.

69 LG Köln (2016) 113 KLs 34/15 (Regional Court of Cologne).

70 BGH (2021) 4 StR 225/20 (The Federal Court of Justice, Germany).

71 BGH (2021) 4 StR 225/20 (The Federal Court of Justice, Germany).

72 This was discussed by Police Officers of the Cybercrime Unit of the Middle Franconia Police Department on a mutual Workshop of the Research Training Group “Cybercrime and Forensic Computung”, FAU Erlangen-Nürnberg and the Middle Franconia Police Department on May 13th 2020.

73 LG Regensburg (2020) Ks 103 Js 28875/19 (Regional Court of Regensburg); see also Michelle Weber, ‘Strafrecht und Sprachassistenz: “Alexa, verrätst du mich?‘ – “Das weiß ich leider nicht“‘ (2021) jM 252.

74 LG Regensburg (2020) Ks 103 Js 28875/19 (Regional Court of Regensburg).

75 Michelle Weber, ‘Strafrecht und Sprachassistenz: “Alexa, verrätst du mich?‘ – “Das weiß ich leider nicht“‘ (2021) jM 252.

76 Minyvonne Burke, ‘Amazon’s Alexa may have witnessed alleges Floria murder, authorities say’ (NBC News 2 November 2019) <https://www.nbcnews.com/news/us-news/amazon-s-alexa-may-have-witnessed-alleged-florida-murder-authorities-n1075621> accessed 15 May 2023.

77 Meagan Flynn, ’Police think Alexa may have witnessed a New Hampshire double homicide – Now they want Amazon to turn her over’ (The Washington Post 14 November 2018) <https://www.washingtonpost.com/nation/2018/11/14/police-think-alexa-may-havewitnessed-new-hampshire-double-slaying-now-they-want-amazon-turn-her-over/> accessed 15 May 2023.

78 State of Arkansas v James Bates Case No CR-2016-370-2 (Ark Cir 2017).

79 Ibid.

80 Haley Sweetland Edwards (2017). ‘Alexa Takes the Stand: Listening Devices Raise Privacy Issues’ (Time 4 May 2017) < https://time.com/4766611/alexa-takes-the-stand-listening-devices-raise-privacy-issues/> accessed 17 May 2023.

81 Thomas Brewster, ‘That Time Cops Searched a Samsung Smart TV for Evidence of Child Abuse.’ (Forbes 7 February 2017) <https://www.forbes.com/sites/thomasbrewster/2017/02/07/samsung-smart-tv-fed-search-child-pornography/?sh=4b0f364917d7> accessed 15 May 2023.

82 Thomas Brewster, ‘Smart Home Surveillance: Governments Tell Google's Nest to Hand Over Data 300 Times’ (Forbes 13 October 2018) https://www.forbes.com/sites/thomasbrewster/2018/10/13/smart-home-surveillance-governments-tell-googles-nest-to-hand-over-data-300-times/?sh=42a602f92cfa accessed 9 April 2024; Thomas Brewster, ‘How An Amateur Rap Crew Stole Surveillance Tech That Tracks Almost Every American’ (Forbes 12 October 2018) <https://www.forbes.com/sites/thomasbrewster/2018/10/12/how-an-amateur-rap-crew-stole-surveillance-tech-that-tracks-almost-every-american/> accessed 9 April 2024. For more information about the case, see: U.S. Attorney's Office, Western District of North Carolina, ‘Leader of Local Hip-Hop Group is Sentenced to Nine Years for Bank and Wire Fraud Conspiracy and Aggravated Identity Theft Charges’ (U.S. Department of Justice 21 March 2019) < https://www.justice.gov/usao-wdnc/pr/leader-local-hip-hop-group-sentenced-nine-years-bank-and-wire-fraud-conspiracy-and> accessed 9 April 2024.

83 Google Nest. ‘Transparency Report.’ (Nest) <https://nest.com/legal/transparency-report/> accessed 15 May 2023.

84 Christine Hauser, ‘Police Use Fitbit Data to Charge 90-Year-Old Man in Stepdaughter’s Killing’ (The New York Times 3 October 2018) <https://www.nytimes.com/2018/10/03/us/fitbit-murder-arrest.html> accessed 15 May 2023.

85 Jamiles Lartey, ’Man suspected in wife's murder after her Fitbit data doesn't match his alibi’ (The Guardian 25 April 2017) <https://www.theguardian.com/technology/2017/apr/25/fitbit-data-murder-suspect-richard-dabate> accessed 15 May 2023; Justin Jouvenal, ‘Commit a crime? Your Fitbit, key fob or pacemaker could snitch on you (Washington Post 9 October 2017) < https://www.washingtonpost.com/local/public-safety/commit-a-crime-your-fitbit-key-fob-or-pacemaker-could-snitch-on-you/2017/10/09/f35a4f30-8f50-11e7-8df5-c2e5cf46c1e2_story.html> accessed 15 May 2023.

86 Amanda Watts, ‘Cops use murdered woman’s Fitbit to charge her husband’(CNN, 26 April 2017) <https://edition.cnn.com/2017/04/25/us/fitbit-womans-death-investigation-trnd/index.html> accessed 15 May 2023, see also William Kendall, ‘“Outrunning” the Fourth Amendment: A Funtional Approach to Searches of Wearable Fitness Tracking Devices’ (2019) 43 S.Ill.U.L.J. 338.

87 John G. Browning and Lisa Angelo, ‘Alexa, Testify’ (The State Bar of Texas) <https://www.texasbar.com/AM/Template.cfm?Section=articles&Template=/CM/HTMLDisplay.cfm&ContentID=46469> accessed 15 May 2023.

88 Jake Prinsen, ‘George Burch conviction upheld by state Supreme Court in murder of Nicole VanderHeyden’ (Green Bay Press-Gazette 29 June 2021) <https://www.greenbaypressgazette.com/story/news/crime/2021/06/29/state-supreme-court-upholds-george-burch-murder-nicole-vanderheyden/7796513002/> accessed 15 May 2023.

89 Commonwealth of Pennsylvania v Jeannine Risley Case No CP-36-CR-0002937 (C P Pa, Lancaster County 2015).

90 Cleve R. Wootson Jr., ‘A man detailed his escape from a burning house. His pacemaker told police a different story’ (Washington Post 8 February 2017) <https://www.washingtonpost.com/news/to-your-health/wp/2017/02/08/a-man-detailed-his-escape-from-a-burning-house-his-pacemaker-told-police-a-different-story/> accessed 15 May 2023.

91 Marie-Helen Maras and Adam Scott Wandt, ‘Case Commentary State of Ohio v. Ross Compton: Internet-Enabled Medical Device Data Introduced as Evidence of Arson and Insurance Fraud.’ (2020) 24(3) IJE & P 321-328.

92 See also Florian Nicolai, Das Internet der Dinge und das Strafrecht - Herausforderungen vernetzter Geräte für das materielle Strafrecht und das Strafprozessrecht (1st edn. Duncker & Humblot, in press) 335 et. seqq.

93 See, for example, Petra Pohlmann, ‘Telematiktarife Existierende Tarifmodelle und ihre Funktionsweisen im KfZ-Bereich‘ in Martin Schmidt-Kessel and Anna Grimm (eds.), Telematiktarife & Co - Versichertendaten als Prämienersatz (Verlag Versicherungswirtschaft 2018), 73, 75; Oliver Brand, ‘Zulässigkeit und Ausgestaltung von Telematiktarifen‘ (2019) VersR 725, 730 et. seq.; Spender A and others, ‘Wearables and the Internet of Things: Considerations for the Life and Health Insurance Industry‘ (2019), 24 Br. Actuar. J. 22.

94 Roderic Ortner and Felix Daubenbüchel, ‘Medizinprodukte 4.0 – Haftung, Datenschutz, IT-Sicherheit‘ (2016) NJW 2918; Stefan Wilmer, ‘Wearables und Datenschutz – Gesetze von gestern für die Technik von morgen?‘ [2015] DSRITB 1.

95 Michael Braun and Volker Nürnberg, ‘Verhaltensbasierte Versicherungstarife – innovative E-Health-Initiative oder Ausstieg aus der Solidargemeinschaft?‘ (2015) 1 G+S 70, 73; see also Doron Rubin, ‘Inhalt und versicherungsrechtliche Auswirkungen der Datenschutz-Grundverordnung‘ (2018) r+s 337, 343.

96 Krol/Boßow-Thies, ‘Akzeptanz von Sprachassistenten zur Steuerung von Smart Home Services‘ in Rüdiger Buchkremer, Thomas Heupel and Oliver Koch (eds.), Künstliche Intelligenz in Wirtschaft und Gesellschaft, (Springer 2020) 517, 523.

97 Hans-Wolfgang Micklitz and Monika Namysłowska, ‘§ 5 UWG‘ in Gerald Spindler and Fabian Schuster (eds.), Recht der elektronischen Medien (4th edn., C.H. Beck 2019) para 75.

98 Oliver Gansser and Christina Reich, ‘Einflussfaktoren auf die Nutzungsabsicht von KI im privaten Umfeld‘, in Rüdiger Buchkremer, Thomas Heupel and Oliver Koch (eds.) Künstliche Intelligenz in Wirtschaft & Gesellschaft (1st edn. Springer 2020), 487, 496, 508 et seqq.

99 Sara E. Kettner and Christian Thorun, ‘Teil 10.4 IoT für Endverbraucher im Smart Home’ in Andreas Leupold, Andreas Wiebe and Silke Glossner (eds.), IT-Recht Recht, Wirtschaft und Technik der digitalen Transformation (4th edn. C.H. Beck 2021) para 22.

100 Roderic Ortner and Felix Daubenbüchel, ‘Medizinprodukte 4.0 – Haftung, Datenschutz, IT-Sicherheit‘ (2016) NJW 2918; Stefan Wilmer, ‘Wearables und Datenschutz – Gesetze von gestern für die Technik von morgen?‘ (2015) DSRITB 1.

101 Sang Y. Lee and Keeheon Lee, ‘Factors that influence an individual’s intention to adopt a wearable healthcare device: The case of a wearable fitness tracker’, (2018) 129 TECHNOL FORECAST SOC 154, 158.

102 Min Zhang and others., ‘Technical attributes, health attribute, consumer attributes and their roles in adoption intention of healthcare wearable technology’ (2017) 108 Int. J. Med. Inform. 97.

103 Scylla and Charybdis are both immortal and irresistible monsters in Greek mythology. To be “between Scylla and Charybdis” therefore means to have to choose between two alternatives, that are both equally unpleasant.

104 Áine MacDermott and others, ‘Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches’ (2019), 10^th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 1.

105 Ibrahim Baggili and others, ‘Watch What You Wear: Preliminary Forensic Analysis of Smart Watches’ (2015) 10^th International Conference on Availability, Reliability and Security, Toulouse, 303.

106 Áine MacDermott and others, ‘Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches’ (2019), 10^th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 1.

107 Áine MacDermott and others, ‘Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches’ (2019), 10^th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 1.

108 Ludovic Barman, ‘Every Byte Matters: Traffic Analysis of Bluetooth Wearable Devices’ (2021), Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 5 (2), article 54.

109 Nicole R. Odom and others, `Forensic Inspection of Sensitive User Data and Artifacts from Smartwatch Wearable Devices´ (2019), Journal of Forensic Sciences, 6.

110 Áine MacDermott and others, `Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches´ (2019), 10^th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 1.

111 Áine MacDermott and others, `Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches´ (2019), 10^th IFIP International Conference on New Technologies, Mobility and Security (NTMS), 1.

112 Scott Helme, ‘Top 1 Million Analysis – November 2021’ (9 December 2021) <https://scotthelme.co.uk/top-1-million-analysis-november-2021/> accessed 17 May 2023.

113 Jorl Winderickx, An Braeken and Nele Mentens, ‘Enhanced end-to-end security through symmetric-key cryptography in wearable medical sensor networks’ (2021) 11, Health Technol. 511.

114 Karim Bayoumy and others ‘Smart wearable devices in cardiovascular care: where we are and how to move forward’ (2021), 18(8), Nat. Rev. Cardiol. 581.

115 C.E. Shannon, ‘Communication theory of secrecy systems’ (1949), 28(4), BSTJ 656.

116 Pengfei Qui and others, Abusing the Processor Voltage to Break Arm TrustZone (2020), 24(2), GetMobile: Mobile Computing and Communications 30.

117 Mathieu Gross and others, Breaking TrustZone memory isolation and secure boot through malicious hardware on a modern FPGA-SoC (2022), J. Cryptogr. Eng. 1.

118 Robert McEvoy and others, Differential power analysis of HMAC based on SHA-2, and countermeasures (2007), In Information Security Applications: 8th International Workshop, WISA 2007, Jeju Island, Korea, August 27, 2007, Revised Selected Papers 8, 317; Marc Stevens and others, The first collision for full SHA-1 (2017). In Advances in Cryptology–CRYPTO 2017: 37th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 20–24, 2017, Proceedings, Part I 37, 570.

Additional information

Funding

The work of authors Nicolai, Trautmann and Schneider was supported by Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) as part of the Research Training Group 2475 “Cybercrime and Forensic Computing” [grant no 393541319/GRK2475/1-2019].