Seventh Circuit Ignores Two Supreme Court Decisions To Hand Out Bad Precedent On Cell Site Location Info

from the doing-nothing-would-have-been-more-useful dept

The Seventh Circuit Appeals Court has issued a dubious ruling [PDF] on cell tower dumps -- one that appears to ignore the Supreme Court's decision declaring warrants are needed to obtain cell site location info. The criminal conduct leading to this questionable finding clearly shows robbing cellphone stores is a particularly bad idea. (h/t Orin Kerr)

[Lawrence] Adkinson and others, in July 2015, robbed a T-Mobile phone store in Clarksville, Indiana, and then a Verizon store in Kentucky the next day. With handguns drawn, they stole approximately 100 cell phones and other items. They later robbed nine additional stores, including three more T-Mobile stores.

T-Mobile investigated the first robberies. As part of its investigation, T-Mobile conducted “tower dumps”: it pulled data from cell sites near the first two victim stores to identify which phones had connected to them—and thus were close to the crimes. From these dumps, T-Mobile determined that only one T-Mobile phone was near both robberies and that Adkinson was an authorized user on that phone’s account.

T-Mobile shared this information with law enforcement, leading to Adkinson's arrest and conviction. Adkinson sought to suppress the evidence law enforcement obtained from T-Mobile, citing the Carpenter decision. If the appeals court had simply pointed out the Carpenter decision does not apply retroactively and moved on, it would have avoided the number of issues it has created with this published opinion, which will set precedent for the circuit.

The least troubling holding is this: T-Mobile did not act as a government agent when it forwarded the results of its internal investigation to law enforcement.

The government responds that the Fourth Amendment was not violated, and we agree for three primary reasons. First, T-Mobile is a private party, and Adkinson has not shown that it was the government’s agent. “A search or seizure by a private party does not implicate the Fourth Amendment” unless the private party “is acting as an instrument or agent of the government.” United States v. Shahid, 117 F.3d 322, 325 (7th Cir. 1997) (internal quotation omitted). To demonstrate agency, Adkinson must establish either that T-Mobile agreed to act on the government’s behalf and to be subject to its control or that the government ratified T-Mobile’s conduct as its own. United States v. Aldridge, 642 F.3d 537, 541 (7th Cir. 2011) (citing RESTATEMENT (THIRD) OF AGENCY §§ 1.01, 4.01 (2006)). T-Mobile, however, acted in its own interest to prevent more robberies of its stores and recover its property when the company furnished data to the government; there is no evidence that it expected to receive any benefit from the government. Providing that data did not transform T-Mobile into an agent of the state.

When a private party hands info to the government, the government doesn't need a warrant to look at whatever has been provided. As long as the government isn't actively encouraging this sharing of information with promises of payments or perks, the Fourth Amendment won't be violated.

But the court goes further than that, suggesting the Carpenter decision doesn't cover tower dumps.

The case did not invalidate warrantless tower dumps (which identified phones near one location (the victim stores) at one time (during the robberies)) because the Supreme Court declined to rule that these dumps were searches requiring warrants. 138 S. Ct. at 2220. Adkinson also relies on policy guidance from the Department of Justice about cell-site data. But that policy guidance, by its own terms, “is not intended to and does not create any right, benefit, trust, or responsibility.”

But that's not what the Supreme Court said. The court said cell site location info is protected by the Fourth Amendment. It did not stick a time limit on historical cell site data, declaring collections over x amount of days to be a search under the Fourth Amendment. Instead, it simply noted the obvious: cellphones are tracking devices people carry with them everywhere they go. This vast amount of precise location info should not be only a subpoena away from the government's possession.

[W]e hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI.

There was no carve-out for tower dumps in the Supreme Court's decision. There's one now in the Seventh Circuit.

More troubling is the court's declaration that -- contrary to the Supreme Court's finding -- clicking OK on a EULA somehow waives the privacy protections the Supreme Court extended to cell site location info.

Adkinson’s Fourth Amendment rights were still not violated because Adkinson consented to T-Mobile collecting and sharing his cell-site information. A defendant can voluntarily consent in advance to a search as a condition of receiving contracted services. See Medlock v. Trustees of Indiana Univ., 738 F.3d 867, 872 (7th Cir. 2013). As a condition of using a phone serviced by T-Mobile, Adkinson agreed to T-Mobile’s policy that T-Mobile could disclose information when reasonably necessary to protect its rights, interests, property, or safety, or that of others. And T-Mobile, in accordance with its policy, shared information with law enforcement after one of its stores was robbed at gunpoint.

If this is what the court wants to believe, then the Carpenter decision no longer exists in the Seventh Circuit. Every cellphone owner agrees to have information collected when they purchase a phone and use the provider's phone service. They may agree this information can be handed over to law enforcement, but the Supreme Court clearly said this does not negate their privacy interest in the information shared with service providers.

As Orin Kerr points out, this ruling also ignores precedent set by another recent Supreme Court ruling. In Byrd, the court held that people who rent cars have a privacy interest in the rented vehicle, one that isn't overcome by the driver not being "authorized" by the rental agreement. In both cases, the court stated that contractual agreements with private companies are not enough to eliminate citizens' Fourth Amendment protections.

What could have been an open-and-shut case reaffirming two obvious conclusions -- the lack of inherent retroactivity in the Carpenter decision and the inability of private searches (T-Mobile's investigation) to violate Fourth Amendment protections -- is instead a mess of precedential hot takes that directly contradict two recent Supreme Court decisions. Citizens residing in this circuit have just been informed their Fourth Amendment isn't worth as much as it is elsewhere in the country.

Filed Under: 7th circuit, cell site, csli, location info, privacy, supreme court

Court Compares Car Crash Data To CSLI, Cellphone Contents; Tells Cops Best Bet Is To Always Get A Warrant

from the I'll-show-you-mine-if-you-show-me-your-[warrant] dept

The Supreme Court's ruling in the Carpenter case came as something of a surprise. The nation's courts seemed unwilling to start paring back the Third Party Doctrine, but the expansion of people's digital footprints following the widespread adoption of smartphones proved to be too big to ignore. The ruling was narrow -- finding only that the acquisition of historical cell site location info (CSLI) was a search under the Fourth Amendment -- but it possibly contains broader applications.

The way it stands now, law enforcement needs a warrant to collect CSLI from cell service providers -- the first hole that's been poked in the Third Party Doctrine since its inception almost 40 years ago. If not for the Riley decision -- the one that recognized phones no longer resembled "containers" or "pockets," but rather contained a detailed depiction of a person's entire life -- the Supreme Court may not have arrived at this conclusion. But it was that decision that first conjured up the image of the government happily discovering people were carrying around personal tracking devices loaded with info 24 hours a day. Grabbing large quantities of CSLI -- 127 days in Carpenter's case -- turned cellphones into ad hoc ankle bracelets, allowing the government to reconstruct someone's movements over a period of months using only a subpoena.

The lower courts are now starting to apply the Carpenter ruling as defendants use this decision to challenge evidence against them. In this case reviewed by the Georgia Court of Appeals, the warrantless acquisition didn't involve cell site location info, but rather a vehicle's black box. Here are the facts of the case, from the decision [PDF]:

On December 15, 2014, the vehicle driven by Victor Lamont Mobley collided with a vehicle driven by W. M. W. M. and the passenger in his vehicle, C. F., were killed in the collision. Mobley was charged with reckless driving, two counts of homicide by vehicle in the first degree (alleging that he caused the deaths of W. M. and C. F. through the act of reckless driving), and speeding (alleging that he drove a vehicle at a speed of 97 miles per hour in a 45-mile-per-hour zone). Mobley moved to suppress evidence that was obtained from the airbag control module (“ACM”) in the vehicle he was driving, which showed that the vehicle was traveling at a speed of 97 miles per hour five seconds before airbag deployment.

Inevitable discovery was the call, with the trial court finding the ACM would have been removed and its data accessed following the crash, so the one-day delay between the original access and the search warrant was negligible. The appeals court dives a little deeper into the issue, bringing along Carpenter for the ride, but not until the concurring opinion. It first takes a look at the implications of the Supreme Court's Riley decision on the warrantless access to otherwise "hidden" info.

Mobley [...] contends that we should follow the reasoning employed by a Florida appellate court, which held (in a divided opinion) that a search warrant was required to access ACM data in an impounded vehicle. The Worsham court found that ACMs “document more than what is voluntarily conveyed to the public and the information is inherently different from the tangible ‘mechanical’ parts of a vehicle.” Citing Riley, supra and analogizing the ACM to a cell phone, the Worsham court reasoned that because the recorded data is not exposed to the public, and because the data is difficult to retrieve and interpret, there is a reasonable expectation of privacy in the data.

The court finds the access of ACM data does not approach the level of privacy intrusion warrantless access to cellphone's contents would. What a driver does on a public road is observable by others, even if not to the level of detail an ACM provides.

We find that, under the circumstances in this case, Mobley did not have a reasonable expectation of privacy in the data from his vehicle’s ACM. See generally Bowling, supra. While an outside observer cannot ascertain the information regarding the use and functioning of a vehicle with the same level of precision as that captured by the ACM, there are outward manifestations of the functioning of some of the vehicle’s systems when a vehicle is operated on public roads. For example, a member of the public can observe a vehicle’s approximate speed; observe whether a vehicle’s brakes are being employed by seeing the vehicle slow down or stop or the brake lights come on, by hearing the sounds of sudden braking; and observe whether the driver is wearing a seatbelt. There is no reasonable expectation of privacy in such information because an individual knowingly exposes such information to the public.

[...]

Information regarding the mechanical functioning of the vehicle and its systems is qualitatively different from photographs, financial information, and other such personal data that may be found on a cell phone.

The Carpenter connection would be long-term data collecting by the ACM, which would allow the government to reconstruct a person's movements over a long period of time. But, as far as the court can tell, most -- if not all -- ACMs only record pertinent info at the time the airbag deploys. It is not a tracking device, wittingly or unwittingly.

The court signs off on its opinion by warning law enforcement that the best route is to always obtain a warrant, if possible.

We therefore limit our holding to the particular facts of this case, and note that future treatment of this issue will likewise depend on the specific facts of the cases under consideration. As such, we reiterate the strong preference for searches to be conducted pursuant to a warrant, see Jones v. State, 337 Ga. App. 545, 548 (1) (788 SE2d 132) (2016), and caution law enforcement officers faced with an investigative need to obtain data from a vehicle’s ACM to err on the side of caution by obtaining a search warrant before retrieving that information.

The concurring opinion notes a few things. First, some ACMs may collect more data than others, making these much more analogous to the CSLI obtained in the Carpenter case. That alone should prompt officers to seek a warrant before downloading the data -- especially when vehicles have been towed and held for a crash investigation. This removes any exigency and allows the search to continue on the court's time, rather than whenever officers feel like it.

It also notes getting a warrant first would be the safer choice as the removal of the ACM may very well qualify as a government trespass onto private property. The automobile exception may excuse cursory searches and inventory of a car's contents if it removed from the scene of a stop, but it does not permit the government to obtain data from a vehicle's electronics.

The opinion reiterates the warning handed out by the majority: Get a warrant.

[L]aw enforcement will find it increasingly tricky to navigate the crossroads of ever-advancing technology and personal privacy as they relate to Fourth Amendment prohibitions. And this difficulty is only exacerbated by the fact that the decisions of the Supreme Court of the United States establish that warrantless searches are typically unreasonable where “a search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing.” But as the Supreme Court emphasized once again in Carpenter v. United States, there remains a tried and true means of safely traversing these crossroads when law enforcement’s specific obligations under the Fourth Amendment are in doubt—get a warrant. This default position seems especially wise in light of the “equilibrium-adjustment” the Supreme Court of the United States recently made in Carpenter.

As for any arguments that new warrant requirements will harm law enforcement efficiency, the court waves them away by explaining the Fourth Amendment isn't supposed to make things easy for the government.

And while obtaining a warrant may not always lend itself to expediency, our republic’s Fourth Amendment jurisprudence has “historically recognized that the warrant requirement is ‘an important working part of our machinery of government,’ not merely an inconvenience to be somehow ‘weighed’ against the claims of police efficiency.”

It also notes that if anyone's losing the Tech Arms Race, it's citizens, not law enforcement. They're at the mercy of a judicial system that isn't known for its turn rate on tech-implicating cases.

I am confident the vast majority of our law enforcement officers will err on the side of caution and liberty, and get a warrant in cases like the one before us. The law always seems to be several steps behind technology, and this approach strikes me as the most prudent course of action going forward.

The main takeaway from Carpenter is this: Get. A. Warrant. Why take a chance a court may find whatever third party data you built a case on to be protected under the Fourth Amendment? A warrant -- even if badly/broadly written -- will generally score law enforcement some points in the "good faith" category, insulating obtained evidence from attempts to have it suppressed.

Filed Under: 4th amendment, black boxes, carpenter, csli, location info, warrant

Supreme Court Says Warrants Are Needed For Cell Site Location Info

from the 4th-Amendment-Bonus-Content! dept

The Supreme Court -- in a narrow decision (both in scope and votes) -- has restored a little more of the Fourth Amendment. The long-awaited decision [PDF] in the Carpenter case has been released and the Supreme Court finds, in a 5-4 decision, that cell site location info (CSLI) is technically a third-party record but worthy of the Fourth Amendment's protection.

The defendant challenged the government's warrantless acquisition of 127 days of CSLI, arguing that the constant location records generated (without proactive assistance from phone users) by cell providers raised enough of a privacy issue the Fourth Amendment was implicated. Somewhat surprisingly -- given the long history of expansive readings of the Third Party Doctrine -- the Supreme Court agrees.

[W]hile the third-party doctrine applies to telephone numbers and bank records, it is not clear whether its logic extends to the qualitatively different category of cell-site records. After all, when Smith was decided in 1979, few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person’s movements.

We decline to extend Smith and Miller to cover these novel circumstances. Given the unique nature of cell phone location records, the fact that the information is held by a third party does not by itself overcome the user’s claim to Fourth Amendment protection. Whether the Government employs its own surveillance technology as in Jones or leverages the technology of a wireless carrier, we hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI. The location information obtained from Carpenter’s wireless carriers was the product of a search.

The court notes simply venturing out into the public does not erase all privacy expectations. The pervasive tracking engaged in by phone companies for business reasons should not undo a person's reasonable expectation of privacy. While the government tried to compare it to tracking vehicles with GPS devices, the court notes that cars cannot go everywhere people go. Long-term tracking -- made possible by provider recordkeeping -- provides the government with detailed depictions of cellphone users' lives. And all of this was -- up until this decision -- only a subpoena away.

[H]istorical cell-site records present even greater privacy concerns than the GPS monitoring of a vehicle we considered in Jones. Unlike the bugged container in Knotts or the car in Jones, a cell phone—almost a “feature of human anatomy,” Riley, 573 U. S., at ___ (slip op., at 9)—tracks nearly exactly the movements of its owner. While individuals regularly leave their vehicles, they compulsively carry cell phones with them all the time. A cell phone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, political headquarters, and other potentially revealing locales.

[...]

Accordingly, when the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.

The ubiquity of cellphones has changed the Third Party Doctrine dynamic. The court isn't willing to give the government warrant-free access to the personal lives of millions of Americans.

Critically, because location information is continually logged for all of the 400 million devices in the United States—not just those belonging to persons who might happen to come under investigation— this newfound tracking capacity runs against everyone. Unlike with the GPS device in Jones, police need not even know in advance whether they want to follow a particular individual, or when.

That's the substance of the decision, but the whole thing is worth reading in full. Even the dissents are worth a read, if only to see how many justices would prefer the government treat long-term tracking as no different than bank records people voluntarily create with every transaction. The court will extend the Third Party Doctrine to cover historical CSLI. However, it does not extend that coverage to cover tower dumps, real-time CSLI (ping orders/Stingray use) or any other records otherwise covered by the Third Party doctrine. But this is still a significant Fourth Amendment win -- and law enforcement agencies using CSLI subpoenas to cover Stingray use will now need to craft warrant requests specifying what they're doing, which will make just a little bit tougher to engage in parallel construction.

More than half the page total is given over to the dissent. Justices Kennedy and Alito have written separate dissents that say pretty much the same thing:

1. The records were obtained from a third party so no warrant should ever be needed.

2. This will law enforcement's work more difficult.

Even if the latter is true, Constitutional protections protect the citizens from their government. If they're an obstacle, they're meant to be. The court isn't there to ensure easy government access. It's there to act as a check against any government overreach it observes.

Justice Thomas' dissent is perhaps the most infuriating read. Much like his dissent in other law enforcement-related cases, Thomas sides with the government while claiming he's siding with the Constitution. His main argument here is that the Fourth Amendment says nothing about privacy or reasonable expectations, therefore the court's decision is wrong. It guards people and papers, not stuff obtained from third parties, no matter how invasive these records can potentially be.

Justice Gorsuch's dissent, however, is an entertaining read. It's really not even a dissent. He agrees with the majority's decision but doesn't think it goes far enough. If Gorsuch had his way, he would also return to a more originalist view of the Fourth Amendment -- the property rights theory he pitched during oral arguments. But unlike Thomas, his would eliminate the court-erected Third Party Doctrine and grant privacy to records created by customers/users and held by third parties. These decisions (Smith, Miller, Katz) would instead be replaced with a property-based treatment of records, giving customers/users more ownership rights to third-party records they create, making them part of the "houses and papers" Fourth Amendment interpretation even if the the "papers" are held by others.

I cannot fault the Sixth Circuit for holding that Smith and Miller extinguish any Katz-based Fourth Amendment interest in third party cell-site data. That is the plain effect of their categorical holdings. Nor can I fault the Court today for its implicit but unmistakable conclusion that the rationale of Smith and Miller is wrong; indeed, I agree with that. The Sixth Circuit was powerless to say so, but this Court can and should. At the same time, I do not agree with the Court’s decision today to keep Smith and Miller on life support and supplement them with a new and multilayered inquiry that seems to be only Katz-squared. Returning there, I worry, promises more trouble than help. Instead, I would look to a more traditional Fourth Amendment approach. Even if Katz may still supply one way to prove a Fourth Amendment interest, it has never been the only way. Neglecting more traditional approaches may mean failing to vindicate the full protections of the Fourth Amendment.

This is a big ruling and it will definitely affect how law enforcement approaches investigations. It will not be well-received by those used to tracking people via subpoena (rather than tail cars and surveillance teams). But it likely won't do much for Carpenter, who will almost certainly find good faith awarded to law enforcement's acquisition of his CSLI records. It will help going forward, but Carpenter will not be a beneficiary.

Filed Under: 3rd party doctrine, 4th amendment, carpenter, csli, location info, privacy, scotus, supreme court

Australian Gov't Scooped Up Tons Of Cell Site Location Data To Track Citizens' Movements

from the serving-the-public-by-eliminating-its-direct-participation dept

A couple of years after it happened, Australian citizens are finally being (indirectly) informed their government harvested cell site location info to track their daily activities. This isn't the work of an intelligence agency or a secretive law enforcement effort. Instead, it's an (unannounced) partnership between the Australian Bureau of Statistics (which handles the Australian Census) and a cellphone service provider. The provider apparently willingly turned over cell site info without a court demand, government mandate, or consultation with its customers. Asher Wolf has the details at Medium:

The ABS claims population estimates have a “major data gap” and so they’ve been a busy bee figuring out a way to track crowd movement. Their solution? Mobile device user data.

“…with its near-complete coverage of the population, mobile device data is now seen as a feasible way to estimate temporary populations,” states a 2017 conference extract for a talk by ABS Demographer Andrew Howe.

While the “Estimated Resident Population” (ERP) is Australia’s official population measure, the ABS felt the pre-existing data wasn’t ‘granular’ enough. What the ABS really wanted to know was where you’re moving, hour by hour, through the CBD, educational hubs, tourist areas.

Third-party records are almost always easily-accessible. They are subject to very limited protections. But generally when the government wants access to records, it's because they're targeting someone in a criminal or national security investigation. What few people expect is for the government to obtain this data en masse, then proudly proclaim its usefulness a couple of years after it's already made use of it.

Cellphone users weren't informed of the government's plans. And the telco made no effort to inform affected customers or give them an opportunity to opt out. While it may look like an innocuous effort to gauge temporary population increases linked to special events and holiday weekends, the information obtained could easily be mined to gain insight on traffic to places of worship, government buildings, airports, workplaces, and protests.

Supposedly, the information has been anonymized. It obviously hasn't been completely stripped of personal information. The slide deck [PDF] detailing the effort notes the data can be broken down by age and sex. The anonymization claim is made without any support from the ABS, which still has yet to provide any further info -- much less a privacy impact assessment -- via its website.

As Wolf points out, the ABS doesn't exactly have a great track record on either data anonymization or protecting the massive amount of data it collects.

Considering the last attempt by a government department to roll-their-own-crypto resulted in the MBS/PBS data breach of 2.5 million Australians, it’d be nice to know exactly how the ABS or telco anonymised and aggregated the data — especially since the ABS on-sells micro-data, from time to time.

As other rights agencies and activists note, the collection of personal info in bulk by the government is always alarming. At best, the techniques deployed here are "deeply unethical." At worst, they conjure images of the worst government behavior: the use of personal info to target specific groups for additional surveillance or internment (as was done with the Japanese during World War II using US Census data). The entire project was undertaken with zero public notice by an agency already known for being cavalier in its treatment of the wealth of personal information obtained through the Census.

ABS has promised more answers but has ignored Wolf's direct questions about study -- including the telco involved and the method used to anonymize the data. When it finally delivers its "detailed information paper" -- two years after the fact -- it's unlikely the details will include the answers Wolf is seeking.

Filed Under: australia, australian bureau of statistics, cell site location info, census bureau, csli, privacy, surveillance, tracking

New York State Appellate Court Says Cell Site Location Records Have No Expectation Of Privacy

from the may-our-children-look-back-at-these-decisions-and-laugh-over-their-avocado-toast dept

The Supreme Court will deliver its ruling on the issue of cell site location info later this year, possibly changing the contours of the Third Party Doctrine for the first time since its erection out of thin air more than four decades ago. Until then, a patchwork of decisions has been handed down by state courts, some finding state law provides more protection for cell phone users than the US Constitution. At the federal level, however, years of precedent has resulted in a mostly-unified front by appellate courts. According to their decisions, cell site location info is a third-party record, undeserving of Fourth Amendment protections.

One of New York State's appellate courts has sided with the federal level. According to its recent decision, there are no privacy expectations in CSLI collected and stored by cell phone providers.

[W]e conclude that the acquisition of that information was not a search requiring a warrant under either the federal or state constitution. As the People point out, this case involves only historical cell site location information, contained in the business records of defendant's service provider, which placed his phone within a certain cell site "sector" at the time he used the phone to make calls, send text messages, or receive calls or messages.

Under these circumstances, we conclude that the acquisition of the cell site location information was not a search under the Fourth Amendment to the federal constitution because defendant's use of the phone constituted a voluntary disclosure of his general location to his service provider, and a person does not have a reasonable expectation of privacy in information voluntarily disclosed to third parties…

The court goes on to declare that even if it had felt like suppressing the evidence and extending privacy protections to CSLI, it wouldn't have helped the defendant.

As a final matter, we agree with the People that any error in the court's refusal to suppress defendant's cell site location information is harmless. The evidence of defendant's identity as a participant in the crime is overwhelming, and there is no reasonable possibility that the verdict would have been different if the location information had been suppressed…

This decision will stand even if the Supreme Court upends 40+ years of Third Party Doctrine rulings. Decisions like these are rarely retroactively applied. Even if Carpenter wins his Supreme Court case, it's likely the lower court will allow the evidence to remain in play, pointing out officers were reasonable to rely on precedential decisions finding no Fourth Amendment protections for third party records. The same goes for the defendant here. Post-decision alterations to the contours of the Constitution rarely help those whose rights have been determined to be violated after the fact.

Filed Under: 4th amendment, cell site location info, csli, expectation of privacy, location info, new york, privacy

Law Prof Argues Cell Location Records Shouldn't Need Warrants Because Cell Phones Have Encryption

from the towards-a-more-government-friendly-reading-of-the-4th-Amendment dept

As the Supreme Court readies itself for an important Fourth Amendment decision, the supporting briefs are beginning to trickle in. At stake is a potential redefining of the expectation of privacy under the Fourth Amendment, something that was diminished by the 1979 Supreme Court decision that created the so-called Third Party Doctrine.

In Carpenter's case, the third party records in question are something gathered by all cell phone companies: location data. The government used months of cell site location data to retrace Carpenter's movements, all without a warrant. This warrantless access turns cell phones into proxy tracking devices for the government. The government is perfectly fine with this turn of events and is asking the Supreme Court to uphold the lower court's decision.

A brief [PDF] siding with the government has been submitted by George Washington University law prof (and Volokh Conspirator) Orin Kerr. In it, Kerr makes some strange arguments.

The least weird argument is Kerr's assertion cell site location records shouldn't be covered by the Fourth Amendment because they are the equivalent of "observation in a public space." This is undoubtedly true, but it does allow the government to perform these "observations" without actually having to use its own eyeballs. Instead of tracking someone's movement through direct, in-person surveillance, the government can serve a subpoena to phone companies and use constantly-collected data to perform retrospective tracking.

Kerr goes on to serve up an analogy to buttress his assertion the Fourth Amendment should provide no protection for ostensibly "public" activities. And that's where the arguments start going off the rails.

[I]magine a world without communications networks. If Alice wants to communicate with Bob, Alice has to leave her home and travel to Bob’s house. If the police suspect that Alice and Bob are conspirators planning a crime, and they assign an officer to watch Alice’s whereabouts, the police can collect only some information without triggering the Fourth Amendment. The police cannot learn the contents of what Alice and Bob said inside Bob’s home without a warrant. On the other hand, the police can observe Alice and see what she did in public – when she left home, where she traveled, when she arrived at Bob’s house, and where they both live – without triggering the Fourth Amendment.

Next imagine that Alice calls Bob on her cell phone instead of meeting him in person. Alice no longer has to travel to meet Bob. The cell phone network delivers the call from Alice to Bob, making a remote transfer that eliminates the need for a public trip. But, critically, the same information exists. What was previously the contents of the conversation in Bob’s house is now the contents of the phone call between Alice and Bob. And what was previously Alice’s publicly observable trip from her house to Bob’s house is now a record that the phone provider generated and may keep about when the call was made, to and from what numbers, and what cell towers were used to deliver it.

What's glossed over in this analogy is the existence of landlines. This middle step is instructive and its absence from Kerr's brief seems almost disingenuous. For years, criminal collaborators used landlines and payphones to converse. This is what the Third Party Doctrine is predicated on: phone records. The Supreme Court's 1979 decision forced companies to comply with (and provide technical assistance for) pen register/trap-and-trace orders. These captured numbers dialed and length of conversations. The only location of interest was already known: the residence/phone booth containing the targeted phone. If law enforcement wanted information on suspects' movements, they still needed to deploy some form of additional surveillance.

Kerr is arguing law enforcement should have access to people's public movements without having to do the actual legwork. And he starts this argument by ignoring the fact law enforcement has -- for years! -- been unable to do anything more than collect phone records sans location data. But now phone records also contain information about people's movements, and Kerr believes they should be inseparable and easily-accessible. This assertion is made despite Kerr attempting to draw a straight line from the good old days of walking from house to house directly through CSLI and email header info.

To maintain the balance of the Fourth Amendment, courts should treat the same information in the same way in both the physical and network contexts. The contents of phone calls should be protected, as they are the telephone equivalent of protected inside space. This means, in the Internet context, that the contents of e-mails, text messages, and files that users place in cloud storage should receive full Fourth Amendment protection. On the other hand, non-content records generated by network providers – the business records they generate about how they delivered the communications – should not be protected because they are the network equivalent of the publicly observable trip that is outside such protection in the physical world.

Going on from there, Kerr says the court -- along with legislators -- must maintain an "equilibrium" between expectations of privacy and lawful access. But in this case, the equilibrium must shift towards the government. Why? Because criminals use cell phones.

The ways that cell phones can facilitate crime and avoid detection counsels against creating new Fourth Amendment protections for cell phone records. Obviously, most people don’t use their phones to commit crimes. But most people don’t have their records collected by court order under the Stored Communications Act, either. The key point is that the effect of cell phone technology on the “often competitive enterprise of ferreting out crime,” Johnson v. United States, 333 U.S. 10, 14 (1948), operates as a two-way street. The ability of cell phone companies to deliver communications quickly and silently over any distance cuts both ways. It can lead to records about the delivery that helps the police, and it can aid in the commission of crime that helps wrongdoers. Both should be considered.

He's right that both should be considered. But his argument doesn't suggest both should be considered. Kerr believes the government's view should be given priority -- a view that allows for no narrowing of the Third Party Doctrine. No one should be granted a higher expectation of privacy because criminals use cell phones. That's basically the argument. And it leads directly to this argument, which isn't any better. The Third Party Doctrine should remain intact because people -- including criminals -- use encryption.

It is too early to tell how far encryption will interfere with government investigative powers. But because users generally can’t encrypt non-content records such as historical cell-site records, the collection of such records may take on a more important role in future surveillance practices. The Court should be reluctant to introduce new constitutional protections for non-content records when the existing constitutional framework for access to contents may be impeded by new encryption technology.

I'm honestly unsure what to make of that argument, which seems to imply the Court should only view the Fourth Amendment as an avenue for law enforcement access, rather than its true purpose: protecting citizens from their government. Kerr talks about maintaining a balance, but posits that relevant technological advancements should work for the government, rather than against it. If people can have encryption and little metal-and-glass rectangles that allow them to hold private, long distance conversations, then the government should have uninterrupted, warrantless access to anything the government deems to be a "third party records."

This isn't the way to maintain balance. The Fourth Amendment isn't the government's enabler. And it never has been. It was written to curb government overreach and abuse. The government has been dealing with unobservable conversations for decades now. That it can now track people without ever leaving the office may be handy, but it doesn't necessarily follow it should always be able to do this without a warrant. The Supreme Court should take a close look at the implications of allowing the status quo to remain in place. Thousands of electronic devices generate millions of third party records every day, all less than a warrant away. Ignoring these implications in favor a simplistic rehashing of a forty-year-old decision is only going to cause further difficulties down the road.

Filed Under: 4th amendment, cell site location info, csli, encryption, location info, orin kerr, scotus, third party doctrine

ACLU Tells Court Long-Term Cell Site Location Tracking Should Require A Warrant

from the people-like-cellphones-much-more-than-they-like-their-government dept

The Supreme Court is going to take a look at the Fourth Amendment implications of warrantless access to historic cell site location information. The outlook for a Fourth Amendment win isn't particularly hopeful, given that there's no circuit split to be resolved. The lone holdout was the Fourth Circuit -- which originally had problems with the long-term collection of location information -- but that court reversed its earlier decision to align with other circuits which have addressed the issue.

That doesn't mean no one should try! Who knows what the court might decide, especially given the shifting telecommunications landscape. After all, it has managed to budge the 4th a wee bit now and then, even in decisions that were mostly punts or calls for the aggrieved to take it up with their Congressional reps.

The ACLU has filed a brief [PDF] on behalf of the appellants, pointing out what should be obvious: cell site location info isn't Just Another Third Party Record. It's a proxy tracking system for law enforcement, which can access this data without warrants. And it's only getting more precise every day.

Service providers have long retained location information for the start and end of incoming and outgoing calls. Today, those companies increasingly also retain location information related to the transmission of text messages and routine internet connections—which smartphones make virtually constantly to check for new emails, social media messages, weather updates, and other functions. The information recorded can include not only cell site and sector, but also estimated distance of the phone from the nearest cell site. Id. Location precision is also increasing as service providers deploy millions of “small cells,” “which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home.” United States v. Graham, 824 F.3d 421, 448 (4th Cir. 2016) (en banc) (Wynn, J., dissenting in part and concurring in the judgment) (citation omitted); see also Hoy, supra, at 69-70. All told, a typical smartphone connects to cell towers hundreds of times a day, generating a densely pixelated matrix of data points documenting the user’s movements. The volume and precision of that data will grow steadily in coming years, generating ever more granular locational information.

The ACLU notes Congress itself has granted consumer protections for CSLI, giving customers control over who has access to this data. Unfortunately, multiple courts have ruled that, since cell providers have access to the info and customers are at least somewhat aware their phones must connect to towers to provide service, this information can be obtained by the government with only a subpoena. (And, obviously, without the customer's consent.) In some rulings, this has been extended to real-time location tracking, with law enforcement officers basically shoulder-surfing telco computers for pings.

The brief draws a connection between virtual location tracking with CSLI and the Supreme Court's Jones decision, which dealt with long-term tracking of individuals with concealed GPS tracking devices. That decision didn't quite establish a warrant requirement, but did suggest warrantless long-term location tracking raised a number of Fourth Amendment issues.

Allowing law enforcement agencies to use service providers as tracking devices is a problem. It shouldn't really make a difference whether it's long-term or short-term, but the tremendous amount of location data automatically gathered can provide an extremely in-depth examination of someone's life, all through the magic of third-party records.

Worse, long-term tracking through CSLI exposes even more of a person's movements to the government. Phones go places cars don't. A suspect could "opt out" of GPS data collection by walking, using public transportation, or riding in vehicles without tracking devices. But people's phones go everywhere they go. Having this wealth of information on tap is a boon for law enforcement. Obtaining a warrant isn't some sort of insurmountable obstacle. The world has changed incredibly since 1979, which is when the Supreme Court created the Third Party Doctrine out of thin air. If nothing else, this case should give it the opportunity to take another look at a decision headed into its fourth decade and see if it still remains relevant in a world where almost every citizen carries around a proxy government tracking device wherever they go.

Filed Under: 4th amendment, csli, location info, supreme court, warrant
Companies: aclu

Another Federal Court Says No Warrants Needed To Obtain Historic Cell Site Location Info

from the personal-tracking-devices dept

The Supreme Court has yet to examine the issue of historical cell site location info(CSLI). It finally picked a case from the Sixth Circuit to review, years after the warrantless gathering of historic CSLI became a thing. So far, there's not a single court in the nation that's found historic CSLI to have an expectation of privacy. The Fourth Circuit Appeals Court briefly did, before reversing its own decision. The original decision had problems with the amount of CSLI gathered: 221 days worth. Upon further review, the court sided with the government and its Third Party Doctrine arguments.

This federal court decision from the Southern District of New York name-checks the pending SCOTUS review, but falls in line with every other decision in the federal court system. The defendant sought to suppress historic CSLI obtained without a warrant, arguing the collection of location data by cell companies is not the same thing as "voluntarily" turning these records over to a third party. (via Courthouse News Service)

From the decision [PDF]:

The relevant question here is whether Serrano voluntarily provided his location to his service provider such that he had no legitimate expectation of privacy in it. The complexity of that question is compounded by the public’s general ignorance regarding the mechanics of how cell phones function, the type of information collected by service providers every time a cell phone is used, or the scope and frequency with which such information is recorded. Serrano contends principally that the third party doctrine has no application to CSLI because it is “not knowingly and intentionally conveyed by the cell phone user to anyone but rather generated automatically by radio waves.” (Mot. at 15–16.) Serrano argues that cell phone users do not actively submit their location information to service providers, nor are they even aware that such information is recorded by service providers without their express consent.

The court disagrees with the defendant's assessment. While it does recognize cellphones are as omnipresent as air, the generation of location data is a necessary function of cell service. Customers -- even if they aren't familiar with the specifics -- do have a general idea their movements are being tracked by every cell tower they connect to.

Though cell phone users do not affirmatively disclose their location to service providers, or understand the breadth of information that is collected through a single phone call, they do know that cell service is necessary to activate their phones. At a minimum, when none of the service bars appear on the interface of a phone, users know that they are “outside the range of the provider company’s cell network.” And when they are in service, they understand that they must “transmit signals to cell towers within range, that the cell tower functions as the equipment that connects the calls, that users when making or receiving calls are necessarily conveying or exposing to their service provider their general location within that cell tower’s range, and that cell phone companies make records of cell-tower usage.” While most people may not be aware of a cell tower’s esoteric functions, they nevertheless understand that by simply placing a call or receiving a text message, they are voluntarily disclosing something location-based and are cognizant that such information will then be used by service providers for a variety of purposes.

The court then goes on to make the argument that even if users weren't voluntarily providing this data, the government would still be able to obtain it without a warrant because the information itself has no expectation of privacy.

However, that a person voluntarily discloses information to third parties does not end the Fourth Amendment inquiry. Privacy interests in such information may exist depending on their substance and nature. There is, of course, a difference between disclosing the phone numbers that are dialed to call someone and the details of a conversation arising from that call. Here, however, CSLI provides no details about a phone call other than the general vicinity where the user placed or received the call. Voluntarily disclosed location information corresponds not to the user’s precise location, but that of the nearest towers.

The court does seem to recognize the current jurisprudence on cellphone data can't remain the way it is now: tied to a 1979 decision (Smith v. Maryland) that predates (and could not have foreseen) the explosion in cellphone use.

It is almost as if cell phone users must relinquish some privacy interests—at least related to their location—as a prerequisite to using a device so embedded in everyday life.

As everything stands now, it's exactly that: cellphone users are generating tons of third party records that can be obtained without a warrant. This includes real-time and near-real time tracking of people's location through tower pings or cell site simulators. For the most part, courts have been extremely hesitant to erect warrant requirements for so-called Third Party records.

This needs to change. Privacy expectations have changed. While most people are aware certain records must be generated to ensure cell service, very few agree the government should be able to track their movements without a warrant, especially over a long period of time. In this case, thirteen MONTHS of cell site location info was obtained by law enforcement, putting the 221 days in the Graham case to shame. When the courts ask themselves what is "reasonable" in terms of expectations of privacy, they need to spend more time considering how much has changed in the world of communications since 1979.

Filed Under: 4th amendment, cell site location info, csli, location, warrants

Supreme Court To Consider Fourth Amendment Implications Of Cell Site Location Info

from the finally...-but-will-it-be-a-decision-we-really-want? dept

We've been waiting a long time for the Supreme Court to tackle the Fourth Amendment implications of cell site location info. After putting it off for as long as possible (or so it seems...), the nation's top court is finally ready to handle yesterday's hotly-disputed tech/privacy issue.

The Supreme Court agreed Monday to hear a case next term challenging the use of cellphone records without a warrant.

The case, Carpenter v. United States, centers on Timothy Carpenter, who was convicted of committing a string of armed robberies of Radio Shack and T-Mobile stores in Michigan and Ohio between December 2010 and March 2011.

The government’s evidence at trial included business records from the defendants’ wireless carriers, showing his cellphone was used within a half-mile to two miles of several robberies during the times they occurred.

The nation's top court seemed to have a pretty good handle on the issues raised by today's smartphones in its Riley decision, so there's some hope the Court will engage in a thorough examination of the Third Party Doctrine in light of today's technological realities.

The Supreme Court turned down a chance to reconcile a circuit split back in 2015. Its decision to take it up now might make this a bit easier, seeing as that split no longer exists. The holdout -- the Fourth Circuit Appeals Court -- reversed its original finding to align it with the other circuits in stating there is no expectation of privacy in third party records.

The case the Supreme Court will examine comes from the Sixth Circuit Court and deals with historical cell site location records. Almost coincidentally, the Sixth Circuit Appeals Court released another cell site opinion the same day the Supreme Court announced its review, only this time dealing with real-time gathering of cellphone GPS data. In both cases, the Appeals Court found no Fourth Amendment implications, even though it had to push through its own contradictory assertions to arrive at this conclusion.

Unfortunately, a previous Supreme Court decision on GPS tracking further complicates the issue. The Court's decision on this issue -- which is very much related to warrantless access to cell site location info -- was about three-quarters punt. It suggested long-term warrantless GPS tracking could violate the Fourth Amendment, but did not go so far as to institute a warrant requirement. It's likely it could arrive at a similar non-decision here -- one that would allow the continued exploitation of the Third Party Doctrine by law enforcement, even though the wealth of data handed over to third parties by today's smartphones bears almost no resemblance to the dialing records discussed in 1979's Smith v. Maryland.

Filed Under: 4th amendment, carpenter v. us, cell site location info, csli, location info, scotus, supreme court, third party doctrine, timothy carpenter

Sixth Circuit Appeals Court Latest To Say Real-Time Cellphone Location Tracking Not A Fourth Amendment Issue

from the unfortunate-unanimity dept

The Sixth Circuit Appeals Court is the latest to weigh in on cell site location info. It joins every other circuit that has handled the issue in deciding the gathering of cellphone GPS data by law enforcement is not a search under the Fourth Amendment.

This decision [PDF] isn't too surprising considering the court reached the same conclusion last year in a similar case. The difference between the two is the latest case deals with real-time collection of GPS data, rather than historical GPS records. But that's the only difference. The Appeals Court believes the same holds true for real-time location info, although it cites something other than 1979's Smith v. Maryland in its analysis.

[T]he district court held—and we affirm, holding that the government’s detection of Montai Riley’s whereabouts in this case, which included tracking Riley’s real-time GPS location data for approximately seven hours preceding his arrest, did not amount to a Fourth Amendment search under our precedent in United States v. Skinner, 690 F.3d 772, 781 (6th Cir. 2012). The government used Riley’s GPS location data to learn that Riley was hiding out at the Airport Inn in Memphis, Tennessee—but only after inquiring of the front-desk clerk did the government ascertain Riley’s specific room number in order to arrest him. The GPS tracking thus provided no greater insight into Riley’s whereabouts than what Riley exposed to public view as he traveled “along public thoroughfares,” id. at 774, to the hotel lobby. Therefore, under Skinner, Riley has no reasonable expectation of privacy against such tracking, and the district court properly denied Riley’s motion to suppress evidence found upon Riley’s arrest.

While tracking a robbery suspect, law enforcement obtained an order demanding AT&T hand over location data as soon as it was collected.

The court order compelled disclosure of call metadata such as inbound and outbound phone numbers and cell-site location (CSL) data, as well as real-time tracking or “pinging” of the latitude and longitude coordinates of Riley’s phone. Specifically, the order required AT&T to disclose the following, potentially for two months, until August 26, 2015:

16. Precision location of mobile device (GPS Location) such that service provider shall initiate a signal to determine the location of the subject’s mobile device on the service provider’s network or with such other reference points as may be reasonable [sic] available and a [sic] such intervals and times as directed by State Task Force Investigators and Deputy Marshals of the United States Marshal Service.

The court goes on to note that the location records submitted as evidence do not show whether this collection of info was triggered by AT&T or by the cellphone's owner.

No evidence of record indicates whether Riley’s phone automatically transmitted its GPS coordinates to AT&T (and if so, whether on a continuous basis or otherwise) or whether AT&T affirmatively sent a signal to Riley’s phone to cause it to send AT&T its GPS coordinates.

This should have been a warning flag. It's one thing to collect this info as it comes in. If AT&T is pinging the phone to generate GPS coordinates, AT&T is essentially performing a search on behalf of the government. That should make a difference in this case, as it shifts it from being about a collection of third-party records to an affirmative gathering of records by the government, using AT&T as a third-party stand-in to work around warrant requirements. (Not that case law is settled for GPS tracking, but still…)

But it doesn't. The court goes on to say it doesn't matter because the records were gathered by a third party and they all dealt with the movement of an individual in a public area (the motel where he was arrested). That's why the court cites the Skinner decision, rather than relying exclusively on Smith v. Maryland.

In Skinner, we held that location data emitted by a “voluntarily procured” cell phone could not be subject to a reasonable expectation of privacy, even if the cell-phone user had no reason to expect that the government would compel the service provider to disclose those data. Id. at 779. There, because “the defendant’s movements could have been observed by any member of the public,” ibid., we held that it could not possibly be a Fourth Amendment violation for law-enforcement officers to monitor those movements by using cell-phone location data just because such electronic monitoring was more efficient than relying on visual surveillance alone.

But it then goes on to reach a conclusion which seems to contradict the evidence provided.

Using seven hours of GPS location data to determine an individual’s location (or a cell phone’s location), so long as the tracking does not reveal movements within the home (or hotel room), does not cross the sacred threshold of the home, and thus cannot amount to a Fourth Amendment search. After all, the tracking in Knotts revealed the location of the cabin to which the criminal suspects had traveled—but the tracking in Knotts was not a search because it revealed no information about the interior of the cabin itself. Likewise here, the tracking revealed only that Riley had traveled to the Airport Inn, not which room (if any) the phone was in at the time of the tracking.

The lack of location info particularity should have worked against the government's argument. The court even admits in a footnote the government had no idea where exactly the suspect was located -- only a general idea that he was likely in a publicly-accessible building.

When viewed on a map, the majority of these coordinates are scattered within the perimeter of the Airport Inn, but with insufficient precision—even if the Airport Inn were only one story tall—to reveal which room, if any, the phone was in at the time of each ping.

So, it could be argued the government did track the suspect's "movements within… a hotel room," which would put this back in Fourth Amendment territory. But the court never attempts to reconcile these contradictory statements and instead continues to use both the motel's accessibility and the coarse location info as an argument against potential Fourth Amendment violations.

That Riley was arrested in a motel is of no moment, for the government learned no more about Riley’s whereabouts from tracking his cell-phone GPS data than what Riley exposed to public view by traveling to the motel lobby “along public thoroughfares,” Skinner, 690 F.3d at 774—even if Riley meant to keep his location a secret, one cannot expect privacy in one’s public movements.

Certainly the arrest was "no moment," but the tracking that occurred once he was inside the building should have been given more consideration. The fact that law enforcement can obtain real-time location tracking information definitely needs to be examined more closely, especially when there's ample evidence law enforcement has effectively backdated orders like these to cover up use of more intrusive technology like Stingray devices.

Filed Under: 4th amendment, 6th circuit, csli, location info, third party doctrine