4th Amendment Lives: Court Tells US Government Get A Warrant If It Wants Mobile Phone Location Info
from the look-at-that dept
A potentially big ruling came out of the courtroom of Judge Lucy Koh yesterday, in which she affirmed a magistrate judge's decision to tell the government to get a warrant if it wants to obtain historical location info about certain "target" mobile phones (officially known as "Cell Site Location Info" -- or CSLI). The government sought to use a provision of the Stored Communications Act (a part of ECPA, the Electronic Communications Privacy Act) to demand this info without a warrant -- using a much lower standard: "specific and articulable facts" rather than the all important "probable cause." Judge Koh says that's doesn't pass 4th Amendment muster, relying heavily on the important Supreme Court rulings in the Jones case, involving attaching a GPS device to a car, and the Riley case about searching mobile phones.Based on the preceding U.S. Supreme Court cases, the following principles are manifest: (1) an individual’s expectation of privacy is at its pinnacle when government surveillance intrudes on the home; (2) long-term electronic surveillance by the government implicates an individual’s expectation of privacy; and (3) location data generated by cell phones, which are ubiquitous in this day and age, can reveal a wealth of private information about an individual. Applying those principles to the information sought here by the government, the Court finds that individuals have an expectation of privacy in the historical CSLI associated with their cell phones, and that such an expectation is one that society is willing to recognize as reasonable.This is big. Obviously, the government is likely to appeal, and so as a first pass, this might seem meaningless. We've still got an appeals court (and possibly a rehearing) and a Supreme Court to get to, but as a first ruling, it's a good one. Koh's analysis is pretty thorough. It notes the similarities to both the Jones and Riley cases:
Here, as in Jones, the government seeks permission to track the movement of individuals—without a warrant—over an extended period of time and by electronic means. CSLI, like GPS, can provide the government with a “comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations.” Riley, 134 S. Ct. at 2490 (quoting Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring)). With the proliferation of smaller and smaller base stations such as microcells, picocells, and femtocells—which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home, ...—the government is able to use historical CSLI to track an individual’s past whereabouts with ever increasing precision. See Riley, 134 S. Ct. at 2490 (explaining that a cell phone’s “[h]istoric location information . . . can reconstruct someone’s specific movements down to the minute, not only around town but also within a particular building”). At oral argument, the government agreed that in some instances CSLI could locate an individual within her home, ... and did not dispute that CSLI will become more precise as the number of cell towers continues to multiply.... This admission is of constitutional significance because rules adopted under the Fourth Amendment “must take account of more sophisticated systems that are already in use or in development.”...Judge Koh points to some survey data from Pew (sent in by EFF) noting that many, many people consider their location information to be "sensitive information" and, on top of that, the fact that CSLI is generated even if someone turns off the GPS or "location data" features on their phone -- meaning they can't even opt out of generating such information to try to keep it private.
In fact, the information the government seeks here is arguably more invasive of an individual’s expectation of privacy than the GPS device attached to the defendant’s car in Jones. This is so for two reasons. First, as the government conceded at the hearing, over the course of sixty days an individual will invariably enter constitutionally protected areas, such as private residences.... Tracking a person’s movements inside the home matters for Fourth Amendment purposes because “private residences are places in which the individual normally expects privacy free of governmental intrusion not authorized by a warrant, and that expectation is plainly one that society is prepared to recognize as justifiable.” Karo, 468 U.S. at 714; see also Kyllo, 533 U.S. at 31 (“At the very core of the Fourth Amendment stands the right of a man to retreat into his own home and there be free from unreasonable governmental intrusion.” (internal quotation marks omitted)). As one court put it, “Because cellular telephone users tend to keep their phone on their person or very close by, placing a particular cellular telephone within a home is essentially the corollary of locating the user within the home.” ....
Second, the government conceded at oral argument that, compared to GPS tracking of a car, the government will “get more information, more data points, on the cell phone” via historical CSLI... (“But, yes, of course the person has the phone more than they have their car, most people at least do, so it gives [the government] more data.”). Cell phones generate far more location data because, unlike the vehicle in Jones, cell phones typically accompany the user wherever she goes.... Indeed, according to a survey cited by the U.S. Supreme Court in Riley, “nearly three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting that they even use their phones in the shower.”....
More importantly, Judge Koh takes on the issue of the infamous third party doctrine and the awful Smith v. Maryland precedent, which says you have no expectation of privacy in data held by third parties. To date, the Supreme Court has punted on this issue in the Jones and Riley cases. However, Koh addresses the issue head on, and says the third party doctrine should not apply to phone location data like this. The key issue: in the Smith case, the "information" that was given to the third party was the phone number being dialed. This was information that the caller voluntarily conveyed to the phone company in order to make the call. Judge Koh points out that this information is quite different:
Cell phone users, by contrast, do not “voluntarily convey” their location to the cellular service provider in the manner contemplated by Miller and Smith. This is especially true when historical CSLI is generated just because the cell phone is on, such as when cell phone apps are sending and receiving data in the background or when the cell phone is “pinging” a nearby cell tower. As the government’s FBI special agent explained, “CSLI for a cellular telephone may still be generated in the absence of user interaction with a cellular telephone.” .... “For example,” the special agent continued, CSLI may be generated by “applications that continually run in the background that send and receive data (e.g. email applications).” ... At oral argument, the government confirmed that its § 2703(d) application authorizes the government to obtain historical CSLI generated by such activities.And thus, even with the third party doctrine, this information is quite different than that discussed in the Smith v. Maryland case, which involved phone numbers dialed:
[....] In so doing, a cell phone periodically identifies itself to the closest cell tower—not necessarily the closest cell tower geographically, but the one with the strongest radio signal—as it moves through its network’s coverage area.... This process, known as “registration” or “pinging,” facilitates the making and receiving of calls, the sending and receiving of text messages, and the sending and receiving of cell phone data.... Pinging nearby cell towers is automatic and occurs whenever the phone is on, without the user’s input or control.... This sort of pinging happens every seven to nine minutes....
In Miller and Smith, the individual knew with certainty the information that was being conveyed and the third party to which the conveyance was made. Cell phone users, on the other hand, enjoy far less certainty with respect to CSLI. CSLI, in contrast to deposit slips or digits on a telephone, is neither tangible nor visible to a cell phone user. When the telephone user in Smith received his monthly bill from the phone company, the numbers he dialed would appear.... The CSLI generated by a user’s cell phone makes no such appearance.... Rather, because CSLI is generated automatically whenever a cell tower detects radio waves from a cell phone, a cell phone user typically does not know that her phone is communicating with a cell tower, much less the specific cell tower with which her phone is communicating.... It may be, as the government explained, that a cell phone connects to “many towers” during the length of a call,... and the tower to which a cell phone connects is not necessarily the closest one geographically.... Moreover, when an app on the user’s phone is continually running in the background, ... she may not be aware that the cell phone in her pocket is generating CSLI in the first place.
In light of the foregoing, the Court concludes that historical CSLI generated via continuously operating apps or automatic pinging does not amount to a voluntary conveyance of the user’s location twenty-four hours a day for sixty days. Such data, it is clear, may be generated with far less intent, awareness, or affirmative conduct on the part of the user than what was at issue in Miller and Smith. Unlike the depositor in Miller who affirmatively conveyed checks and deposit slips to the bank, or the telephone user in Smith who affirmatively dialed the numbers recorded by the pen register, a cell phone user may generate historical CSLI simply because her phone is on and without committing any affirmative act or knowledge that CSLI is being generated. Smith, for example, never contemplated the disclosure of information while the landline telephone was not even in use.Judge Koh notes that this ruling isn't rejecting the ruling in Smith -- rightly noting that only the Supreme Court can determine that it's no longer good law -- but notes that the ruling there is different enough from this one that it does not apply. Ideally, the Supreme Court will get around to rejecting the ridiculous third party doctrine altogether, but if it must stand, a ruling like this is helpful in returning just a bit of 4th Amendment protected privacy to the American public.
This sort of passive generation of CSLI does not amount to a voluntary conveyance under the third-party doctrine.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 4th amendment, csli, ecpa, location information, lucy koh, privacy, probable cause, sca, warrant
Companies: aclu, eff
Reader Comments
Subscribe: RSS
View by: Time | Thread
Wasn't she the judge who presided over the travesty of Apple's patent-trolling of Samsung?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
The appeal will be interesting to see
This will not likely stand on appeal but it will be interesting to see if the government's effort on the appeal argument will be significantly better than "we don't like this, make it go away". Or whether they cannot really be bothered with maintaining the illusion that the U.S. is a nation governed by law.
[ link to this | view in chronology ]
Re: The appeal will be interesting to see
You are already sharing the data with someone, we will just get it from THEM with a NSL!
hahaha... fuck this judge, we didn't need her anyways!
tis but a flesh wound!
[ link to this | view in chronology ]
Third party doctrine
I do wish however that we could start talking about the difference in privacy between sharing information with a business vs. Government. Sharing my email or searches with Google, or my purchasing patterns with Visa, or my dialed numbers (and location) with my phone provider, is voluntary. I can easily choose another provider of their service or choose other alternatives (e.g. cash instead of credit card, paper mail instead of email) if they behave badly, such as publish or leak my private details, or deliver intrusive advertising.
More importantly though, unlike the Government, the business can't violate my constitutional rights or deprive me of liberty based on what I share with them. Allowing the Government to easily access that same data is entirely different, as they can send me to GITMO or at a minimum destroy my life trying to defend myself.
The dangers of Government access to masses of data I chose to (privately) share with a business in exchange for a service are clear and obvious, and should require a court approved warrant.
[ link to this | view in chronology ]
Re: Third party doctrine
Notwithstanding the telemarketing scammers I've had businesses assume I've consented to telemarketing calls (including to my cel phone) simply because I did business with one of their units. No I did not say or write anywhere such consent. And I did business with 'business X', NOT 'parent of business X'. As far as I'm concerned the 'parent' is a different business. I had to write them to get them to stop; most never replied but the legitimate calls have stopped.
As far as I'm concerned unwanted telemarketing is a deprivation of liberty.
[ link to this | view in chronology ]
Re: Re: Third party doctrine
But it's awfully hard to ignore some ladder-climbing attorney in the Justice Department. The Government's power far exceeds that of a telemarketer to make your life suck. No comparison.
[ link to this | view in chronology ]
Re: Re: Re: Third party doctrine
It's not easy to ignore incoming calls that drain your ten buck a month pay as you go minutes, and why is it incumbent upon us to stop them? They should be forced to get permission to start in the first place.
They're our phones, not theirs! We're paying the bill for it. Why are we expected to accept (eg.) Verizon getting its corporate nose out of joint so we end up getting robo-called half a million times because their billing data is SNAFU'd?
As for the comparison between some schmuck prosecutor vs. privates screwing with you, I'd rather have neither, thank you very much. One baddie with huge power vs. a thousand ticks sucking your blood are equally unattractive to me. They're both evil.
[ link to this | view in chronology ]
Re: Third party doctrine
[ link to this | view in chronology ]
Meanwhile in the whitehouse......
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Wow, she totally nailed it. It's great that there are people who actually understand technology. The legal professionals that did the research in order to come to this ruling deserve a lot of praise.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
So, what's it really like to live in a cave? Do they come with heat these days? Do you have animal paintings on the walls and everything? How about plumbing?
I suspect the EFF website can provide all the evidence you're looking for. IJJ is worth looking into as well.
[ link to this | view in chronology ]
There's a waterproof phone?
[ link to this | view in chronology ]
Re: There's a waterproof phone?
[ link to this | view in chronology ]
Re: Re: There's a waterproof phone?
[ link to this | view in chronology ]
Re: There's a waterproof phone?
When I'm in the shower, I'm generally showering. This sounds like a really dumb idea to me. I don't want to be hunting for the soap I dropped or a cell phone.
Perhaps a wallmounted waterproof display could make sense, but it's going to get all fogged up in there. How's about finishing your shower, then check mail as your hair's drying?
[ link to this | view in chronology ]
http://www.zeit.de/datenschutz/malte-spitz-data-retention
[ link to this | view in chronology ]