Supreme Court Says Warrants Are Needed For Cell Site Location Info

from the 4th-Amendment-Bonus-Content! dept

The Supreme Court -- in a narrow decision (both in scope and votes) -- has restored a little more of the Fourth Amendment. The long-awaited decision [PDF] in the Carpenter case has been released and the Supreme Court finds, in a 5-4 decision, that cell site location info (CSLI) is technically a third-party record but worthy of the Fourth Amendment's protection.

The defendant challenged the government's warrantless acquisition of 127 days of CSLI, arguing that the constant location records generated (without proactive assistance from phone users) by cell providers raised enough of a privacy issue the Fourth Amendment was implicated. Somewhat surprisingly -- given the long history of expansive readings of the Third Party Doctrine -- the Supreme Court agrees.

[W]hile the third-party doctrine applies to telephone numbers and bank records, it is not clear whether its logic extends to the qualitatively different category of cell-site records. After all, when Smith was decided in 1979, few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person’s movements.

We decline to extend Smith and Miller to cover these novel circumstances. Given the unique nature of cell phone location records, the fact that the information is held by a third party does not by itself overcome the user’s claim to Fourth Amendment protection. Whether the Government employs its own surveillance technology as in Jones or leverages the technology of a wireless carrier, we hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI. The location information obtained from Carpenter’s wireless carriers was the product of a search.

The court notes simply venturing out into the public does not erase all privacy expectations. The pervasive tracking engaged in by phone companies for business reasons should not undo a person's reasonable expectation of privacy. While the government tried to compare it to tracking vehicles with GPS devices, the court notes that cars cannot go everywhere people go. Long-term tracking -- made possible by provider recordkeeping -- provides the government with detailed depictions of cellphone users' lives. And all of this was -- up until this decision -- only a subpoena away.

[H]istorical cell-site records present even greater privacy concerns than the GPS monitoring of a vehicle we considered in Jones. Unlike the bugged container in Knotts or the car in Jones, a cell phone—almost a “feature of human anatomy,” Riley, 573 U. S., at ___ (slip op., at 9)—tracks nearly exactly the movements of its owner. While individuals regularly leave their vehicles, they compulsively carry cell phones with them all the time. A cell phone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, political headquarters, and other potentially revealing locales.

[...]

Accordingly, when the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.

The ubiquity of cellphones has changed the Third Party Doctrine dynamic. The court isn't willing to give the government warrant-free access to the personal lives of millions of Americans.

Critically, because location information is continually logged for all of the 400 million devices in the United States—not just those belonging to persons who might happen to come under investigation— this newfound tracking capacity runs against everyone. Unlike with the GPS device in Jones, police need not even know in advance whether they want to follow a particular individual, or when.

That's the substance of the decision, but the whole thing is worth reading in full. Even the dissents are worth a read, if only to see how many justices would prefer the government treat long-term tracking as no different than bank records people voluntarily create with every transaction. The court will extend the Third Party Doctrine to cover historical CSLI. However, it does not extend that coverage to cover tower dumps, real-time CSLI (ping orders/Stingray use) or any other records otherwise covered by the Third Party doctrine. But this is still a significant Fourth Amendment win -- and law enforcement agencies using CSLI subpoenas to cover Stingray use will now need to craft warrant requests specifying what they're doing, which will make just a little bit tougher to engage in parallel construction.

More than half the page total is given over to the dissent. Justices Kennedy and Alito have written separate dissents that say pretty much the same thing:

1. The records were obtained from a third party so no warrant should ever be needed.

2. This will law enforcement's work more difficult.

Even if the latter is true, Constitutional protections protect the citizens from their government. If they're an obstacle, they're meant to be. The court isn't there to ensure easy government access. It's there to act as a check against any government overreach it observes.

Justice Thomas' dissent is perhaps the most infuriating read. Much like his dissent in other law enforcement-related cases, Thomas sides with the government while claiming he's siding with the Constitution. His main argument here is that the Fourth Amendment says nothing about privacy or reasonable expectations, therefore the court's decision is wrong. It guards people and papers, not stuff obtained from third parties, no matter how invasive these records can potentially be.

Justice Gorsuch's dissent, however, is an entertaining read. It's really not even a dissent. He agrees with the majority's decision but doesn't think it goes far enough. If Gorsuch had his way, he would also return to a more originalist view of the Fourth Amendment -- the property rights theory he pitched during oral arguments. But unlike Thomas, his would eliminate the court-erected Third Party Doctrine and grant privacy to records created by customers/users and held by third parties. These decisions (Smith, Miller, Katz) would instead be replaced with a property-based treatment of records, giving customers/users more ownership rights to third-party records they create, making them part of the "houses and papers" Fourth Amendment interpretation even if the the "papers" are held by others.

I cannot fault the Sixth Circuit for holding that Smith and Miller extinguish any Katz-based Fourth Amendment interest in third party cell-site data. That is the plain effect of their categorical holdings. Nor can I fault the Court today for its implicit but unmistakable conclusion that the rationale of Smith and Miller is wrong; indeed, I agree with that. The Sixth Circuit was powerless to say so, but this Court can and should. At the same time, I do not agree with the Court’s decision today to keep Smith and Miller on life support and supplement them with a new and multilayered inquiry that seems to be only Katz-squared. Returning there, I worry, promises more trouble than help. Instead, I would look to a more traditional Fourth Amendment approach. Even if Katz may still supply one way to prove a Fourth Amendment interest, it has never been the only way. Neglecting more traditional approaches may mean failing to vindicate the full protections of the Fourth Amendment.

This is a big ruling and it will definitely affect how law enforcement approaches investigations. It will not be well-received by those used to tracking people via subpoena (rather than tail cars and surveillance teams). But it likely won't do much for Carpenter, who will almost certainly find good faith awarded to law enforcement's acquisition of his CSLI records. It will help going forward, but Carpenter will not be a beneficiary.

Filed Under: 3rd party doctrine, 4th amendment, carpenter, csli, location info, privacy, scotus, supreme court

4th Circuit Appeals Court Rolls Back Its Warrant Requirement For Cell Site Location Info

from the the-'summer-of-the-Fourth-Amendment'-is-so-last-year dept

The Fourth Circuit Court of Appeals was one of the few appeals courts to rule on the constitutionality of obtaining cell site location info without a warrant. And it was -- was -- the only appeals court to find warrantless access violated the Fourth Amendment. The decision was limited to the collection of historical cell site data for extended periods of time (the court appeared to believe anything beyond two weeks was questionable), mainly because there was a good chance the records would contain considerable detail about a person's movements in private places.

The government immediately requested an en banc hearing by the Appeals Court. The hearing was granted and the court has patched up its split with the other circuits by finding in favor of the government and the Third Party Doctrine. [PDF link]

We now hold that the Government’s acquisition of historical CSLI from Defendants’ cell phone provider did not violate the Fourth Amendment.

Supreme Court precedent mandates this conclusion. For the Court has long held that an individual enjoys no Fourth Amendment protection “in information he voluntarily turns over to [a] third part[y].” Smith v. Maryland, 442 U.S. 735, 743-44 (1979). This rule -- the third-party doctrine -- applies even when “the information is revealed” to a third party, as it assertedly was here, “on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.” United States v. Miller, 425 U.S. 435, 443 (1976).

All of our sister circuits to have considered the question have held, as we do today, that the government does not violate the Fourth Amendment when it obtains historical CSLI from a service provider without a warrant. In addition to disregarding precedent, Defendants’ contrary arguments misunderstand the nature of CSLI, improperly attempt to redefine the third-party doctrine, and blur the critical distinction between content and non-content information.

The Supreme Court may in the future limit, or even eliminate, the third-party doctrine. Congress may act to require a warrant for CSLI. But without a change in controlling law, we cannot conclude that the Government violated the Fourth Amendment in this case.

The nod to 1979's Smith v. Maryland is back in place, setting this decision firmly in Third Party Doctrine territory. If it's "voluntarily conveyed" to a third party, the government doesn't need a warrant to access it. The key, though, is the "voluntary" part. While the majority finds the collection of cell site location data by service providers to be somehow a "voluntary" conveyance by customers, the three dissenting judges aren't as impressed by this argument.

The dissenting opinion (starting at p. 47) goes through the majority decision's citations and sees a whole lot more voluntary effort being made by citizens than what happens during the automatic acquisition of cell site info by phone companies.

The Supreme Court, then, has intentionally employed the “voluntary conveyance” concept in every relevant case to limit the reach of an otherwise sweeping per se rule that denies Fourth Amendment protection. It seems therefore crucial here to ask: what, precisely, did the Court mean when it chose those words, in the context of those cases?

Here is what those various defendants actually did to “voluntarily convey” information. One used his finger to dial, one by one, the numerical digits of a telephone number. Smith, 442 U.S. at 741 (highlighting that pen registers disclose “only the telephone numbers that have been dialed” (quoting United States v. N.Y. Tel. Co., 434 U.S. 159, 167 (1977))). Another submitted multiple checks and deposit slips—each presumably bearing a date, a dollar amount, a recipient name, and a personal signature. Miller, 425 U.S. at 442. The others actually spoke. White, 401 U.S. at 746–47 (conversations with a bugged government informant related to narcotics transactions); Hoffa, 385 U.S. at 296 (statements to an associate “disclosing endeavors to bribe [jury] members”); Lewis, 385 U.S. at 210 (conversations with an undercover law enforcement agent in the course of executing a narcotics sale).

In all of these cases—the only cases that can bind us here— “voluntary conveyance” meant at least two things. First, it meant that the defendant knew he was communicating particular information. We can easily assume Miller knew how much money he was depositing, that Smith knew the numbers he was dialing, and that Hoffa, Lewis, and White knew about the misconduct they verbally described to another.

Second, “voluntary conveyance” meant that the defendant had acted in some way to submit the particular information he knew. Crucially, there was an action—depositing, dialing, speaking— corresponding to each piece of submitted information. And where many data pieces were compiled into records—financial records in Miller, phone records in Smith—there was presumptively a discrete action behind each piece of data. The Court never suggested that the simple act of signing up for a bank account, or a phone line, was enough to willingly turn over thousands of pages of personal data.

The dissent goes on to point out that CSLI -- unlike other "voluntarily conveyed" third-party records -- isn't even made available to the customers that generate it. Customers have access to call records, bank statements, and other information collected under the Third Party Doctrine, but there's no easily-accessible way for citizens to view the location records they're conveniently generating for the government. This lack of access to information strongly suggests the collection of cell site location data by phone companies has nothing to do with voluntary conveyance.

The majority believes that if a "fix" is required, it should be left to legislators.

The legislative branch is far better positioned to respond to changes in technology than are the courts.

This is said with a straight face before using the Electronic Communications Privacy Act as an example of legislators' prowess: a law gives the government access to the contents of any electronic communications older than 180 days -- and which has yet to be updated in any serious form by legislators over the past 30 years, even as the tech landscape surrounding it has experienced monumental changes.

The majority maintains Congress "has not been asleep at the switch" since the ECPA's institution. And it's somewhat correct. Attempts have been made to rewrite the law in reaction to the explosion of electronic communications since the mid-80s, but forward motion has been stalled by government agencies unwilling to cede ground to shifting expectations of privacy. So, yes, Congress can fix it, but it needs to run a gauntlet of agencies it's in no hurry to anger and administrations that overwhelmingly oppose any minimal contractions of government reach or power. And if Congress hasn't made any significant progress towards trimming back the Third Party Doctrine's overgrowth since 1979's Smith v. Maryland decision, it's tough to believe that this is the decade where it will finally make its move.

Filed Under: 3rd party doctrine, 4th amendment, cell site location info, csli, location, privacy, warrants

Samsung's Smart TVs Are Collecting And Storing Your Private Conversations

from the I-hear-the-secrets-that-you-keep/when-you-talk-by-the-TV dept

Guess who's eavesdropping on you now? It's not some nefarious government agency (although, rest assured, there has been no downturn in surveillance). Nope, it's that smart TV you paid good money for and invited into your home.

The "now" is misleading. Smart TVs have been doing this ever since manufacturers decided customers preferred to order their electronics around orally, rather than using the remote they can never find. And that's just the "eavesdropping" part. Most smart TVs are harvesting plenty of data on top of that, including viewing habits, search terms, browsing history… pretty much anything that makes a TV "smart" is collected and transmitted not just to the manufacturer, but to plenty of unknown third parties. Usually, this information is used to send "relevant ads" to TV owners, as if the several hundred dollars spent on the device wasn't enough of a revenue stream.

Samsung -- which is currently catching a lot of internet heat for its so-called "Privacy Policy" -- is no exception. It's the wording used that's making it the target du jour, turning other recent privacy policy villains (LG: "agree to share damn near everything or enjoy your super-expensive 'stupid' TV"; Microsoft: "why don't we just treat your living room like a movie theater and use our camera technology to count heads and charge increased VOD 'admission'") into distant memories.

Under "Voice recognition," Samsung's privacy policy says this:

To provide you the Voice Recognition feature, some voice commands may be transmitted (along with information about your device, including device identifiers) to a third-party service that converts speech to text or to the extent necessary to provide the Voice Recognition features to you. In addition, Samsung may collect and your device may capture voice commands and associated texts so that we can provide you with Voice Recognition features and evaluate and improve the features. Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition.

Obviously, some very temporary "collection" and "transmission" needs to take place to allow a third party service to "recognize" the user's voice and ensure the smart TV does what it's told. But Samsung also collects and captures these communications... and it doesn't really say how, where or for how long these are stored.

The EFF's Parker Higgins noted that Samsung's voice recognition policy sounds eerily like the description of "telescreens" from George Orwell's really-not-supposed-to-be-a-blueprint-for-the-future 1984.

Left: Samsung SmartTV privacy policy, warning users not to discuss personal info in front of their TV Right: 1984 pic.twitter.com/osywjYKV3W

— Parker Higgins (@xor) February 8, 2015

Compare Samsung's wording...

Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition.

with Orwell's:

The telescreen received and transmitted simultaneously. Any sound that Winston made, above the level of a very low whisper, would be picked up by it, moreover, so long as he remained within the field of vision which the metal plaque commanded, he could be seen as well as heard. There was of course no way of knowing whether you were being watched at any given moment…

You had to live--did live, from habit that became instinct--in the assumption that every sound you made was overheard, and, except in darkness, every movement scrutinized.

Fun stuff. The only thing missing from the scenario is a government intermediary. But it's not much a stretch to insert one.

It could certainly be construed that any personal communications collected and stored by Samsung would fall under the Third Party Doctrine. If a government agency (local law enforcement, FBI, etc.) wishes to acquire these, they wouldn't face much of a challenge because of the lowered expectation of privacy. If Suspect X is viewed carrying a Samsung smart TV into his home, law enforcement could issue a subpoena to Samsung to acquire any voice recordings it had collected from that device. Eavesdropping by proxy. Discuss a drug deal in front of the TV? Here come the cops. No warrants or wiretaps needed.

This hypothetical would require law enforcement to know the device's ID number, something that would be hard to obtain without an actual search warrant. In the most likely scenario, the voice recognition data would be collected after a regular search had been completed. Now, previous conversations people thought no one heard could be introduced as evidence against them, thanks to the widescreen narc installed on the premises.

Here's a hypothetical that's even more "fun" to consider: a law enforcement agency is aware certain smart TVs collect and store voice recordings (along with viewing habits, internet browsing history, search terms, etc.) So, officers kick off a gun amnesty program where unregistered weapons can be turned in for free big screen TVs. Now, this law enforcement agency has a small army of hi-def confidential informants installed in numerous homes. All data can be collected at the agency's convenience, using little more than the "unregistered guns must belong solely to criminals" rationale.

But Samsung isn't the only device manufacturer collecting, storing and transmitting its customers' everyday conversations. Others do it, too. Some just hide it better. In LG's 50+ pages of smart TV fine print, it says the following about voice recognition:

I agree that LG Electronics Inc. ("LGE") may process Voice Information in the manner set out in the Privacy Policy and below.

Voice Information refers to the recording of voice commands and associated data, such as information about the input device that is used to record commands (e.g., Magic Remote or built-in microphone), OS information, TV model information, content provider, channel information and service results.

I understand and agree that Voice Information may be use for the purpose of powering the voice activation feature when used to control, receive, and improve LG Smart TV Services and as described in the Privacy Policy.

I further understand and agree that LGE may share Voice Information with third parties, including providers of voice analytics.

I understand and agree that Voice Information may be transferred to, and used by, third party service providers on LGE's behalf in various countries around the world (including Korea), some of which may not offer the same level of data protection, for the purposes set out in the Privacy Policy.

And there's your Third Party Doctrine. All anyone arguing for the right to subpoena voice information has to do is point to the User Agreement as clear evidence that the person in question is voluntarily turning over voice recordings to a third party. And away goes the expectation of privacy.

We don't expect our devices to send overheard conversations to anyone other than the voice recognition technology provider. But they do. And they send it (and store it) without providing any specifics about the unnamed third parties, where they're located, how secure these transmissions are (to protect them from criminals -- the other unwanted "third parties") or how long the manufacturer itself retains this data.

The transparency level of these manufacturers rivals that of the government. And that's not a good thing, because it makes it far too easy for them to become willing partners with agencies that thrive on the abuse of the Third Party Doctrine. Samsung -- and manufacturers like it -- need to provide more than vague assurances. They need to explicitly explain what's happening to all the data they're collecting, especially when the collection involves entertainment devices listening in on private conversations... and calling it a "feature."

Filed Under: 1984, 3rd party doctrine, conversations, privacy, smart tvs, surveillance
Companies: lg, samsung

Appeals Court Says Using Open WiFi May Be A Crime

from the uh-oh dept

For many years, we've had ongoing debates about whether or not it's ethical or legal to use open WiFi connections. It's one of those debates that never seem to stop. Unfortunately, in a ruling yesterday, the Third Circuit appeals court suggested that merely using an open WiFi network may be a criminal act. This is hugely problematic for a variety of reasons.

The case is mainly about the question of whether or not police need a warrant to track down someone connecting to a neighbor's open WiFi. In fact, on first reading it, I had thought that I'd lump it in with yesterday's big victory for the 4th Amendment in the 11th Circuit, saying that police need to get a warrant for mobile phone location. The main thrust of this new ruling is that police do not need a warrant to use a tool called "MoocherHunter" to track down who is likely using someone else's WiFi. While I'm a big 4th Amendment fan, this ruling actually makes a fair bit of sense on that front, as I'll explain below. But eventually, it runs into serious trouble with some offhand comments towards the end.

In this case, police were trying to track down someone downloading and sharing child pornography via a P2P setup, and were able to track down the IP address. After visiting the residence associated with the IP address, the police quickly realized that no one in the house was the likely person involved with child porn (there was no child porn on the computers, nor the file sharing software with a matching user ID). From there, the police asked the residents to cooperate by installing "MoocherHunter" to try to track down who was actually connecting to their open router. It's worth noting that the police actually had a "lengthy discussion" with federal prosecutors over whether or not a warrant was needed for MoocherHunter first, and they concluded it wasn't needed.

Eventually, the results were narrowed down to the likely culprit, Richard Stanley, and the police then got a warrant to search that guy's apartment, leading him to confess (after first trying to run away). Stanley's computer also contained the child porn. Stanley tried to suppress the evidence, arguing that the use of MoocherHunter required a warrant, not unlike the Kyllo ruling that found that police needed a warrant to use a thermal imaging device from outside someone's house to detect if there was enough heat inside to support probable cause for growing marijuana. The court here notes that while, superficially, these may look similar (a device pointed at someone's residence), the reality is that they were quite different, because Kyllo was about looking inside someone's house to see what they were doing in the privacy of their own home, whereas MoocherHunter was about identifying someone who had reached out of their own home into someone else's space to make use of their WiFi connection.

Critical to Kyllo’s holding, however, was the fact that the defendant sought to confine his activities to the interior of his home. He justifiably relied on the privacy protections of the home to shield these activities from public observation. See Kyllo, 533 U.S. at 34 (characterizing the thermal imaging scan as a “search of the interior of [Kyllo’s] home[],” which it considered to be “the prototypical . . . area of protected privacy”). See 13 also id. at 37 (“In the home, our cases show, all details are intimate details, because the entire area is held safe from prying government eyes.”) (emphasis in original).

Stanley can make no such claim. Stanley made no effort to confine his conduct to the interior of his home. In fact, his conduct—sharing child pornography with other Internet users via a stranger’s Internet connection—was deliberately projected outside of his home, as it required interactions with persons and objects beyond the threshold of his residence. In effect, Stanley opened his window and extended an invisible, virtual arm across the street to the Neighbor’s router so that he could exploit his Internet connection. In so doing, Stanley deliberately ventured beyond the privacy protections of the home, and thus, beyond the safe harbor provided by Kyllo....

The court further emphasizes that since MoocherHunter only revealed the path, but not the content, Stanley has even less privacy interest. That all makes some amount of sense. The court then has an interesting discussion about the third party doctrine, and whether or not Smith v. Maryland applies to Stanley's signals. In this case, it concludes it does not. And while the reasoning is a bit convoluted, this seems important:

Were we to hold that Stanley exposed his “signal” under Smith by transmitting it to a third-party router, we might open a veritable Pandora’s Box of Internet-related privacy concerns. The Internet, by its very nature, requires all users to transmit their signals to third parties. Even a person who subscribes to a lawful, legitimate Internet connection necessarily transmits her signal to a modem and/or servers owned by third parties. This signal carries with it an abundance of detailed, private information about that user’s Internet activity. A holding that an Internet user discloses her “signal” every time it is routed through third-party equipment could, without adequate qualification, unintentionally provide the government unfettered access to this mass of private information without requiring its agents to obtain a warrant. We doubt the wisdom of such a sweeping ruling, and in any event, find it unnecessary to embrace its reasoning.

That's a very good ruling. But, then, suddenly, the ruling goes off the rails, saying that merely connecting to the open WiFi itself may have been a criminal act:

The presence of Stanley’s signal was likely illegal. A large number of states, including Pennsylvania, have criminalized unauthorized access to a computer network. A number of states have also passed statutes penalizing theft of services, which often explicitly include telephone, cable, or computer services. We need not decide here whether these statutes apply to wireless mooching, but the dubious legality of Stanley’s conduct bolsters our conclusion that society would be unwilling to recognize his privacy interests as “reasonable.”

Yikes. While the court acknowledges in a footnote that this issue is somewhat contested, it's incredibly problematic in general. Just the idea that this is unauthorized access is a big problem, because it's not unauthorized. The neighbors left their WiFi open, and thus, by default, it is sending out signals that effectively say "welcome, feel free to connect to this network." It is authorized by the very nature of the setup of the network. Thus, it's quite questionable to argue that this is either unauthorized access or "theft of services." The court doesn't even seem to consider this. And while this part is not central to the overall ruling, it is still quite troubling to have that on the record in an appeals court ruling.

Filed Under: 3rd circuit, 3rd party doctrine, 4th amendment, kyllo, moocherhunter, mooching, open wifi, richard stanley, warrants, wifi

FISA Court Tries, Once Again, To Justify Allowing Bulk Collection Of Data On All Your Phone Calls

from the let's-try-this-again dept

Last week, the FISA Court (FISC) renewed yet again (as it has every few months for over 7 years) the ability of the government to demand data on every phone call from American telcos. Last month, the FISC (for the first time) published its rationale for allowing the collection -- one that many experts found extremely lacking. Not only did the court incorrectly state that members of Congress were fully aware of the details of the program when they renewed it, but it also made up some of its own rules and ignored some of the Supreme Court's statements on such forms of data collection.

Today, the court has declassified the new justification that was written up for this latest round of rubber-stamping, and it's written by a different judge than before. This time, it's Judge Mary McLaughlin, who notes that this is the first time she's had to review such an application, but for the most part she "agrees with and adopts" the reasoning used back in July by Judge Eagan to justify the collection. However, she also attempts to go into a little more detail, perhaps in response to the public criticism to Eagan's reasoning. Eagan's ruling stated the following:

In light of the importance of the national security programs that were set to expire, the Executive Branch and relevant congressional committees worked together to ensure that each Member of Congress knew or had the opportunity to know how Section 215 was being implemented under this Court's Documentation and personnel were also made available to afford each Member full knowledge of the scope of the implementation of Section 215 and of the underlying legal interpretation.

Unfortunately, as many have pointed out (and the White House has admitted) this is not true. Rep. Mike Rogers did not share the details with members of the House, despite the White House recommending strongly that he do so. While he did set up "briefings" with the NSA, they were clearly designed to keep Representatives in the dark. Among the many tricks that Rogers pulled, was sending announcements of the briefings to what's considered the "spam folder" of representatives, holding them at very inconvenient times (when most Reps. were out of town) and then leaving it up to the Reps. to guess what they should be asking about.

In this latest ruling, McLaughlin doesn't make the claim as directly as Eagan did, but still suggests that every member of Congress "had the opportunity to learn about the scope of the metadata collection and this Court's interpretation of Section 215." Thus, because they reauthorized it (thanks mostly due to fear-mongering by the heads of the Intelligence Committees), it must mean that Congress approved of the interpretation of the law. That seems specious, at best. It's increasingly clear that the heads of the intelligence committees actively sought to mislead others in Congress over these programs. Pretending that they were well informed is simply fiction. The very fact that so many in Congress (including some on the Intelligence Committee) have noted that they were kept in the dark about many important details, Judge McLaughlin is playing games here that don't reflect reality.

She also attempts to deal with the fact that in the Jones GPS case, the Supreme Court indicated that when there's bulk collection of data, it's possible to cross over from not being a 4th Amendment violation, to being one. In other rulings, the suggestion had been that if a single data point wasn't a 4th Amendment violation, then the bulk collection couldn't be either -- even though Justice Alito's opinion in Jones strongly argued otherwise. McLaughlin tries to hand-wave this away:

The Supreme Court's more recent decision in United States v. Jones... does not point to a different result here. Jones involved the acquisition of a different type of information through different means.

More specifically, she argues that because Jones was about monitoring and this case is about collection it's different. That also seems questionable, as Alito himself made the comparison to wiretapping. To argue that they're not analogous seems like it's ignoring what was said. McLaughlin does, legitimately, point out that Justice Sotomayor's opinion suggested that the whole notion of the 3rd party doctrine (saying there's no 4th Amendment protection for information given to a third party) should be revisited, but that the Court declined to do so in Jones.

Hopefully, this is setting up a situation in which the Supreme Court will no longer be able to punt the issue, as it did in Jones, and we can get some renewed respect for the 4th Amendment, especially in cases where bulk data is collected and accessed by government officials.

Filed Under: 3rd party doctrine, bulk collection, fisa, fisa court, fisc, metadata, patriot act, section 215, supreme court

Press Suckered By Anti-Google Group's Bogus Claim That Gmail Users Can't Expect Privacy

from the no-expectation-of-accuracy dept

Okay, so as a bunch of folks have been sending over today, there's been a bit of a furor over a press release pushed out by Consumer Watchdog, a hilariously ridiculous group that has decided that Google is 100% pure evil. The "story" claims that Google has admitted in court that there is no expectation of privacy over Gmail. This is not actually true -- but we'll get to that. This story is a bit complex because the claims in most of the news coverage about this are simply wrong -- but I still think Google made a big mistake in making this particular filing. So, first, let's explain why the coverage is completely bogus trumped up bullshit from Consumer Watchdog, and then we'll explain why Google still shouldn't have made this filing.

First off, you may recall Consumer Watchdog from previous stunts such as a putting together a hilariously misleading and almost 100% factually inaccurate video portrayal of Eric Schmidt, which was all really part of an effort to sell more copies of its founder's book (something the group flat out admitted to us in an email). They're not a consumer watchdog site -- they're a group that makes completely hogwash claims to try to generate attention on a campaign to attack Google.

The press release from Consumer Watchdog fits along its typical approach to these things: take something totally out of context, put some hysterical and inaccurate phrasing around it, dump an attention-grabbing headline on it and send it off to the press. In this case, it claimed that Google had said in a court filing that you have no expectation of privacy with Gmail. That got a bunch of folks in the press to bite with wildly inaccurate headlines:

• CNET: Google filing says Gmail users have no expectation of privacy
• Time: Google Says Gmail Users Have ‘No Legitimate Expectation of Privacy’
• The Guardian: Google: Gmail users shouldn't expect email privacy
• Gizmodo: Google: Non-Gmail Users Have No Legitimate Expectation of Privacy
• Huffington Post: Google: Email Users Can't Legitimately Expect Privacy When Emailing Someone On Gmail
• Business Insider: GOOGLE: If You Send To Gmail, You Have 'No Legitimate Expectation Of Privacy'

The first three of those headlines are simply flat-out factually incorrect. I mean, not even close, and it's fairly incredible that those come from the three more "established" or "mainstream" news publications. The last three are slightly more correct, but still completely miss the point. The best debunking of these claims so far comes from Nilay Patel at the Verge who breaks down the details. The filing, which is from over a month ago, is a response to an absolutely, monumentally bogus class action lawsuit filed against Google, arguing, hilariously, that it's a violation of wiretap laws to put ads next to emails based on the text of those emails. No, seriously.

As Patel points out, first, if you put the argument back into context, it's not even about Gmail users -- as the top three headlines above falsely state. Google is arguing that non-Gmail users are consenting to the fact that when they send an email, the ISPs who receive the email will automatically process them. This should not be controversial. At all. Without that concept email doesn't work. As the filing states (which the folks hyping this ignore):

Non-Gmail users who send emails to Gmail recipients must expect that their emails will be subjected to Google's normal processes as the [email] provider for their intended recipients.

In other words, there's no "there" there. All Google was arguing was that courts have held that if you are using a communication service, there's a perfectly reasonable (in fact, expected) recognition that the service provider will have the right to process some information about that communication. In the context of the case that Google cites, the infamous Smith v. Maryland, the argument is that the business provider is reasonably expected to be able to track the user's activity. That's not controversial. The controversial step that Smith v. Maryland then makes is to argue that because the service provider has a right to that basic information it means that the end user has no expectation of privacy with regards to the government getting access to the same info. That's the problem with Smith v. Maryland -- the failure to recognize that massive difference between me (1) consenting to let my phone company record who I make phone calls to in exchange for the ability to make calls and (2) the expectation that it's okay for the government to collect that very same info without a warrant.

Google's citation of Smith v. Maryland is to make the first half of that argument -- showing that courts recognize the obvious: that when you use a communication service, there are certain aspects of information that you know the service provider is going to have access to. Without that you don't have email, or (realistically speaking) the internet.

So, this is all much ado about nothing.

Except... I still think it was a mistake for Google to use this legal argument, and I'm somewhat surprised Google's legal team let this go through in place. First, Google does not need this citation to make this point. There are other cases that can make this point effectively without touching on the government spying aspect. But, the real reason why this is a mistake is that Google has given fairly strong indications in recent statements that it's willing to fight back against certain government requests for user info (and that it's done so in the past). In those cases, the government is absolutely going to cite Smith v. Maryland as its evidence that users have no expectation of privacy in their communications and now they'll also point out that Google cited the case approvingly. Google will want to argue that Smith v. Maryland is outdated law and was decided wrongly and/or in a different time under a different technology ecosystem. And this is a very, very strong argument that has a good chance of winning. But the ability of the government to point out that Google has, in other cases, cited the Smith precedent approvingly -- even if it was really only part of the Smith precedent -- could undermine their arguments against Smith in future cases down the road.

Either way: the freakout here is totally manufactured by a bogus, laughable group that is spreading ideas that would do massive harm to the internet based on a near total ignorance of how things work. Yes, people are on edge given the NSA revelations, but this "gotcha" is no "gotcha" at all. It's just more evidence of the sheer duplicity of Consumer Watchdog. That said, it was still short-sighted for Google to make this claim in a filing. They didn't need the citation, and while it may help them win this ridiculous class action lawsuit, it may come back to bite them down the road in more important cases.

Filed Under: 3rd party doctrine, consumer watchdog, email, fearmongering, government, hype, journalism, privacy, smith v. maryland, surveillance
Companies: consumer watchdog, google

How Defenders Of NSA Dragnet Surveillance Are Stretching A 1979 Ruling To Pretend It's Constitutional

from the not-quite dept

Defenders of the legality of the NSA's dragnet approach to surveillance often point to the concept of the third party doctrine, and specifically to the case Smith v. Maryland, in which the Supreme Court said that it was okay for law enforcement to get phone records without a warrant because the information was held by a "third party" and the original caller had no expectation of privacy in data given to that third party. We've questioned the legitimacy of the third party doctrine for years, and folks like Al Gore and Alan Grayson have discussed why it's a stretch to say that the ruling applies to the NSA hoovering up all phone call data.

Jim Harper, who has spent more time than anyone I know thinking about the third party doctrine over the years, has a good post explaining some of the history and why it's a huge stretch to say that Smith v. Maryland means the NSA can scoop up all data:

On the question of whether surveillance of every American's phone calling is constitutional, Lee notes how the government and its defenders will rely on a 1979 case called Smith v. Maryland. In that case, the government caused a telephone company to install a pen register at its central offices to record the numbers dialed from the home of a suspected robber. Applying doctrine that emerged from Katz v. United States (1967), the Court found that a person doesn't have a "reasonable expectation of privacy" in phone calling information, so no search occurs when the government collects and examines this information.

It takes willfulness of a different kind to rely on Smith as validation the NSA's collection of highly revealing data about all of us. Smith dealt with one suspect, about whom there was already good evidence of criminality, if not a warrant. The NSA program collects call information about 300+ million innocent Americans under a court order.

More importantly, however, Harper points out that the Supreme Court's more recent decisions suggest that it is moving away from the third party doctrine as established in that Katz case that the court relied on for Smith v. Maryland:

And the Supreme Court is moving away from Katz doctrine, having avoided relying on it in recent major Fourth Amendment cases such as Jardines (2013), Jones (2012), and Kyllo in 2001.

In other words, the facts of the NSA dragnet are extremely different than the facts in Smith v. Maryland, and the Supreme Court itself appears to at least be less willing to immediately give the stamp of approval to any collection of "third party" data as somehow being immune from the 4th Amendment. Defenders of the NSA spying like to just say "Smith v. Maryland" and act like that settles everything. However, it's far from clear that it applies at all in this case.

Filed Under: 3rd party doctrine, nsa, nsa surveillance, privacy, supreme court

The Real Scandal: Not That The NSA Broke The Law In Vast Spying, But That It Probably Didn't

from the the-law-is-broken dept

There's a good point being raised by a bunch of people lately in reaction to the details of the NSA surveillance revelations from last week. A number of the program's defenders, including those in Congress and the White House (all the way up to Obama) have defended the program as being legal. And, technically, they may be right. Thanks to a combination of questionable legal rulings and then Congress passing bad and dangerous laws over the past few decades, many of these practices likely are "legal." And thus, the real scandal here may not be that this data collection was happening in the first place, but that it was legal too.

As much as one might be personally appalled by the notion of the NSA collecting everybody's call records, disgust doesn't make something unconstitutional. Rather, the real scandal here is what's legal -- namely, how the surveillance powers enabled by modern technology have been embraced and expanded by Congress and a succession of presidents, and how the Court has failed to develop a robust system for applying the Fourth Amendment meaningfully to the questions of the 21st century.

This is why many of us have been trying to call attention to things like warrantless wiretapping and the FISA Amendments Act and the privacy-destroying immunities of CISPA for years. Because those in power keeping screaming "terrorists!" to get Congress to pass these laws, and then everyone's shocked (shocked!) when the government goes and does what Congress and the courts have specifically allowed.

The article above points to the infamous Smith v. Maryland case, which among other things established the ridiculous third party doctrine, which we've decried for years. This ruling said that by "giving" data (such as phone numbers) to a "third party" (such as a phone company) you had given up any expectation of privacy in that data. That ruling was made in 1979, but is now used to suggest you've given up an expectation of privacy in lots of data you give to online services. That needs to go. But, at the same time, Congress is equally guilty of regularly approving massive expansions of the law that enables all of this kind of surveillance.

The "good news" in all of this (if there is any good news) is that if it's true that everything that was done didn't actually violate the law, then we just need to fix the laws, and that may actually be an easier problem to solve (though, by no means easy) than dealing with what to do if laws were broken.

In a weird twist, the best-case scenario is that the NSA's surveillance programs are legal -- or, at least, that the NSA believes that they are. The administration has certainly expanded its powers to fill every crack available, but it seems not to have broken any bricks, hewing assiduously to the letter of the law (as far as we know). It may be of small comfort, but overly broad laws are an easier problem to solve than that of a government that does whatever it wants, regardless. Let's hope that that is not what we have.

Of course, for that to happen, we'd have to have some faith that Congress will actually do it's job. And that's such a laughable thought that I almost couldn't complete that sentence.

Filed Under: 3rd party doctrine, 4th amendment, fisa amendments act, nsa, nsa surveillance, patriot act