Ottawa Police Ordered to Return Phones After Failing 175 Million Passcode Attempts

An Ontario court decision has put a cap on how many attempts police can make trying to unlock digital devices belonging to an alleged criminal.

The case involved three cell phones that were seized as part of a police investigation into child pornography in October 2022.

“Forensic investigators have tried about 175 million different passcodes in an effort to view the contents of the phones but have had no success,” Ontario Superior Court Justice Ian Carter wrote.

Police applied to the court for permission to hold on to the devices and keep trying to crack the codes. They had applied to extend the detention orders for the phones twice before, court documents show.

The phones are locked with “complex-alpha-numeric passcodes,” according to the court documents, which noted that there are 44 nonillion potential passcodes for each phone—specifically 44,012,666,865,176,569,775,543,212,890,625.

Related Stories

The 175,000,000 codes the investigators tested over the course of a year are “only an infinitesimal number” in comparison, the judge wrote.

Justice Carter said the court needed to balance the property rights of the accused and the interest in preserving evidence during investigations into criminal activity.

“[The phones] have no value in and of themselves at the moment. Their value for a criminal prosecution will only be realized if the passwords are cracked and evidence of an offence is uncovered on them,” he wrote.

“From a property perspective,” he added, “phones have value as a tool.”

He said that the police needed to show that the further holding of the phones is “warranted.”

“In my view, the evidence on this application establishes that further detention of the phones is not warranted because there is little hope that the passwords will be cracked in a reasonable period of time.”

Justice Carter said the odds of the police cracking the codes of the phones were “so incredibly low as to be virtually non-existent.”

“A detention order for a further six months, two years, or even a decade will not alter the calculus in any meaningful way,” he wrote. “The phones will continue to have almost no evidentiary value … As a result, I conclude that a further detention order is not warranted.”

‘Complex Passcodes’

Uncovering alpha-numeric passcodes can only be done through “a brute force process,” Justice Carter said in the court decision.

These passwords use a combination of letters and numbers to create words, such as f34r for fear or @lert for alert. It’s called leet speak, the court said.

Ottawa police used what is called a dictionary attack, which uses a list of pre-set words, which were from open sources, according to Justice Carter.

Justice Carter said he was not putting a time limit on the investigation, as he said it could continue even without the phones.