Sixth Circuit Appeals Court Latest To Say Real-Time Cellphone Location Tracking Not A Fourth Amendment Issue

from the unfortunate-unanimity dept

The Sixth Circuit Appeals Court is the latest to weigh in on cell site location info. It joins every other circuit that has handled the issue in deciding the gathering of cellphone GPS data by law enforcement is not a search under the Fourth Amendment.

This decision [PDF] isn't too surprising considering the court reached the same conclusion last year in a similar case. The difference between the two is the latest case deals with real-time collection of GPS data, rather than historical GPS records. But that's the only difference. The Appeals Court believes the same holds true for real-time location info, although it cites something other than 1979's Smith v. Maryland in its analysis.

[T]he district court held—and we affirm, holding that the government’s detection of Montai Riley’s whereabouts in this case, which included tracking Riley’s real-time GPS location data for approximately seven hours preceding his arrest, did not amount to a Fourth Amendment search under our precedent in United States v. Skinner, 690 F.3d 772, 781 (6th Cir. 2012). The government used Riley’s GPS location data to learn that Riley was hiding out at the Airport Inn in Memphis, Tennessee—but only after inquiring of the front-desk clerk did the government ascertain Riley’s specific room number in order to arrest him. The GPS tracking thus provided no greater insight into Riley’s whereabouts than what Riley exposed to public view as he traveled “along public thoroughfares,” id. at 774, to the hotel lobby. Therefore, under Skinner, Riley has no reasonable expectation of privacy against such tracking, and the district court properly denied Riley’s motion to suppress evidence found upon Riley’s arrest.

While tracking a robbery suspect, law enforcement obtained an order demanding AT&T hand over location data as soon as it was collected.

The court order compelled disclosure of call metadata such as inbound and outbound phone numbers and cell-site location (CSL) data, as well as real-time tracking or “pinging” of the latitude and longitude coordinates of Riley’s phone. Specifically, the order required AT&T to disclose the following, potentially for two months, until August 26, 2015:

16. Precision location of mobile device (GPS Location) such that service provider shall initiate a signal to determine the location of the subject’s mobile device on the service provider’s network or with such other reference points as may be reasonable [sic] available and a [sic] such intervals and times as directed by State Task Force Investigators and Deputy Marshals of the United States Marshal Service.

The court goes on to note that the location records submitted as evidence do not show whether this collection of info was triggered by AT&T or by the cellphone's owner.

No evidence of record indicates whether Riley’s phone automatically transmitted its GPS coordinates to AT&T (and if so, whether on a continuous basis or otherwise) or whether AT&T affirmatively sent a signal to Riley’s phone to cause it to send AT&T its GPS coordinates.

This should have been a warning flag. It's one thing to collect this info as it comes in. If AT&T is pinging the phone to generate GPS coordinates, AT&T is essentially performing a search on behalf of the government. That should make a difference in this case, as it shifts it from being about a collection of third-party records to an affirmative gathering of records by the government, using AT&T as a third-party stand-in to work around warrant requirements. (Not that case law is settled for GPS tracking, but still…)

But it doesn't. The court goes on to say it doesn't matter because the records were gathered by a third party and they all dealt with the movement of an individual in a public area (the motel where he was arrested). That's why the court cites the Skinner decision, rather than relying exclusively on Smith v. Maryland.

In Skinner, we held that location data emitted by a “voluntarily procured” cell phone could not be subject to a reasonable expectation of privacy, even if the cell-phone user had no reason to expect that the government would compel the service provider to disclose those data. Id. at 779. There, because “the defendant’s movements could have been observed by any member of the public,” ibid., we held that it could not possibly be a Fourth Amendment violation for law-enforcement officers to monitor those movements by using cell-phone location data just because such electronic monitoring was more efficient than relying on visual surveillance alone.

But it then goes on to reach a conclusion which seems to contradict the evidence provided.

Using seven hours of GPS location data to determine an individual’s location (or a cell phone’s location), so long as the tracking does not reveal movements within the home (or hotel room), does not cross the sacred threshold of the home, and thus cannot amount to a Fourth Amendment search. After all, the tracking in Knotts revealed the location of the cabin to which the criminal suspects had traveled—but the tracking in Knotts was not a search because it revealed no information about the interior of the cabin itself. Likewise here, the tracking revealed only that Riley had traveled to the Airport Inn, not which room (if any) the phone was in at the time of the tracking.

The lack of location info particularity should have worked against the government's argument. The court even admits in a footnote the government had no idea where exactly the suspect was located -- only a general idea that he was likely in a publicly-accessible building.

When viewed on a map, the majority of these coordinates are scattered within the perimeter of the Airport Inn, but with insufficient precision—even if the Airport Inn were only one story tall—to reveal which room, if any, the phone was in at the time of each ping.

So, it could be argued the government did track the suspect's "movements within… a hotel room," which would put this back in Fourth Amendment territory. But the court never attempts to reconcile these contradictory statements and instead continues to use both the motel's accessibility and the coarse location info as an argument against potential Fourth Amendment violations.

That Riley was arrested in a motel is of no moment, for the government learned no more about Riley’s whereabouts from tracking his cell-phone GPS data than what Riley exposed to public view by traveling to the motel lobby “along public thoroughfares,” Skinner, 690 F.3d at 774—even if Riley meant to keep his location a secret, one cannot expect privacy in one’s public movements.

Certainly the arrest was "no moment," but the tracking that occurred once he was inside the building should have been given more consideration. The fact that law enforcement can obtain real-time location tracking information definitely needs to be examined more closely, especially when there's ample evidence law enforcement has effectively backdated orders like these to cover up use of more intrusive technology like Stingray devices.

Filed Under: 4th amendment, 6th circuit, csli, location info, third party doctrine

Fifth Circuit Says No Warrants Needed To Obtain Near-Real Time Cell Site Location Info

from the prospective-records-just-records-apparently dept

The Fifth Circuit Appeals Court has issued a ruling on cell site location data which basically gives the government permission to engage in real-time tracking without a warrant. The acquisition of historical cell site location data is still the source of much judicial dispute. But at the federal appellate level, courts that have handled these cases have decided no warrant is needed. Location records are just another thing law enforcement can have warrantless access to, thanks to the Third Party Doctrine.

Prospective location records, like those obtained in this case, have received less scrutiny. While ostensibly third party records, these allow for "real-time" tracking of individuals using records flowing directly to law enforcement almost as quickly as they're obtained by the cell service provider. A defendant tracked using this poor man's Stingray moved to have the evidence suppressed, arguing the near-real time warrantless "search" violated his Fourth Amendment rights. The court disagreed, finding the momentary landing at the service provider was enough to make them third party records, even if law enforcement was figuratively (or possibly literally) hovering over the cell provider's shoulder as the location records rolled in. From the ruling [PDF]:

There is little distinction between historical and prospective cell site data. As in Historical Cell Site Data, here the government sought “the disclosure of the locations of cell site towers being accessed by [Wallace’s] cell phone” as recorded in future records “captured, stored, recorded and maintained by the phone companies in the ordinary course of business.” “While this information is ‘prospective’ in the sense that the records had not yet been created at the time the order was authorized, it is no different in substance from the historical cell site information . . . at the time it is transmitted to the government.” Booker, 2013 WL 2903562, at *7. The information the government requested was, “in fact, a stored, historical record because it [was] received by the cell phone service provider and stored, if only momentarily, before being forwarded to law enforcement officials.”

So, as it stands here (and in other courts), the government is free to obtain phone records from the past and the future -- and, with a "momentary" landing, location records as they're produced. As the court states here, third party records are third party records, whether or not they've been created yet. Even if the officers were wrong about this, the good faith exception would have allowed them to keep the fruits of their search, according to the court.

It's not a great decision. It allows law enforcement to ask for nearly any cell site location records without stating more than a few "articulable facts." An order could be fashioned to serve as open-ended surveillance, allowing officers to track someone for an indefinite amount of time without ever showing a law enforcement need to do so. It also could serve as cover for Stingray use by providing a parallel set of "real-time" location records.

What the decision doesn't explicitly do is give law enforcement permission to deploy Stingrays without warrants. Stingrays turn the government into the "third party," which isn't an acceptable use of the Third Party Doctrine. But that's another area federal courts really haven't delved into yet -- not because Stingray use is so limited, but because the FBI-enforced secrecy surrounding cell tower spoofers has prevented defendants from mounting many successful challenges. Charges tend to be dismissed if defendants get too close to the truth.

It's a published opinion so it has a little precedential weight. But the opinion spends more time quoting other opinions than breaking much new ground here. Unfortunately, the ground broken here is more victim-blaming, reminding defendants it's their own fault they use cellphones, as if most cellphones users were keenly aware their phones act as tracking devices… and as if it weren't a massive law enforcement boon that all of this info can be had without a warrant, thanks to a doctrine in severe need of a massive update.

Filed Under: 4th amendment, cell site location info, csli, searches, third party doctrine, warrants

New Law In Illinois Restricts Stingray Use, Requires Court Orders For Deployment

from the the-warrant-that-dare-not-speak-its-name dept

Roughly eight years after information about law enforcement use of Stingray devices began slowly making its way into the public sphere, positive changes are being made. While the government has often argued it can be the "Third Party" in "Third Party Doctrine" by inserting itself warrantlessly between people's cell phones and their carriers' towers, its assertions are being met with increased judicial skepticism.

Two judges -- one state, one federal -- have reached the same conclusion in recent months: using a cell tower spoofer to locate suspects by dragging information out of their phones is a search under the Fourth Amendment. Warrants are required.

A few state legislatures have gotten into the act as well, proposing laws that create a warrant requirement for Stingray deployment. Illinois is the latest to do so (and the law actually passed), creating a new set of guidelines for law enforcement Stingray device use, including limits on data retention. It doesn't go quite so far as to mandate warrant acquisition, but it does force law enforcement to specify the equipment used in their applications, which also serves to create a paper trail that can be examined by defendants and members of the public.

This is the new quasi-warrant requirement recently signed off on by the governor.

Provides that an application for a court order to use a cell site simulator device, including an emergency application under the Freedom From Location Surveillance Act, must include a description of the nature and capabilities of the cell site simulator device to be used and the manner and method of its deployment, including whether the cell site simulator device will obtain data from non-target communications devices. Provides that an application for a court order to use a cell site simulator device, including an emergency application under the Freedom From Location Surveillance Act, must also include a description of the procedures that will be followed to protect the privacy of non-targets of the investigation, including the immediate deletion of data obtained from non-target communications devices.

The presentation of probable cause basically makes it a warrant requirement, even if the word "warrant" appears nowhere in the legislation.

The other positive here is that very strict controls on the use and retention of non-hit data are being instituted as well.

Provides that if the cell site simulator device is used to locate or track a known communications device, all non-target data must be deleted as soon as reasonably practicable, but no later than once every 24 hours. Provides that if the cell site simulator device is used to identify an unknown communications device, all non-target data must be deleted as soon as reasonably practicable, but no later than within 72 hours of the time that the unknown communications device is identified, absent a court order preserving the non-target data and directing that it be filed under seal with the court.

An additional nice touch is that requests and orders aren't considered "sealed" by default and that any seal request granted only lasts six months, and extension requests must be accompanied by a certification indicating the documents are part of an ongoing investigation or a "showing of exceptional circumstances." The last one is a little worrying as it could be used to maintain seals indefinitely if the court is inclined to believe law enforcement claims about "exposing law enforcement means/methods."

This show of "support" from local law enforcement indicates the law isn't as far-reaching as privacy activists might have hoped, but it isn't exactly just a bundle of concessions to LEO interests either.

The Illinois State Police has taken a neutral position on the law and the Chicago Police Department did not take a position.

Expect this trend to continue. More courts and legislators are going to realize that tracking a person's location by forcing their cell phone to connect with law enforcement technology is in no way analogous to gathering phone records with a pen register order or subpoenaing historical cell site data from third-party carriers.

Filed Under: 4th amendment, court orders, illinois, imsi catcher, stingray, third party doctrine, warrants

National Intelligence Office's Top Lawyer Fires Off Spirited Defense Of Bulk Surveillance, Third Party Doctrine

from the "in-order-for-programs-to-remain-legal,-I-must-view-it-this-way" dept

Robert Litt, General Counsel for the Office of the Director of National Intelligence, has been given space at the Yale Law Review Journal to publish his citable article "Why Everyone's Wrong About the Fourth Amendment." Or, as Litt would like us to refer to it:

Preferred Citation: Robert S. Litt, The Fourth Amendment in the Information Age, 126YALE L.J. F. 8 (2016), http://www.yalelawjournal.org/forum/fourth-amendment-information-age.

To be fair, Litt never says we're all wrong about the Fourth Amendment and the Third Party Doctrine. He only says Judge Leon is. Judge Leon was the single district court judge who found the bulk collection of phone metadata to be unconstitutional.

Technically, we're not all wrong, but we may as well be, because no court has found the collection unconstitutional save Judge Leon's and Litt doesn't agree with it. Several paragraphs follow, but the crux of Litt's argument is nothing new: it's just 1979's Smith v. Maryland decision all over again.

I do not think that Judge Leon’s efforts to distinguish Smith were successful. First, while Judge Leon is certainly right that metadata can be very revealing of personal activities, there is nothing new about that insight. Justice Stewart dissented from the decision in Smith itself in part because he recognized that metadata “easily could . . . reveal the most intimate details of a person’s life.” The point of Smith was not that metadata is innocuous, but that you have chosen to reveal it to a third party. To use an analogy, if you give a document to a third party, you have lost your expectation of privacy in that document, whether it is a laundry ticket or a confession of mortal sin. Moreover, the fact that cell phones today contain a lot of information beyond metadata does not seem relevant when the government did not actually search or collect any of that other information.

[...]

[I] find it hard to understand the alchemy by which information that you choose to disclose to a third party develops an expectation of privacy because you have chosen to disclose a lot of that information. That seems counter-intuitive to say the least. For all of these reasons, if you accept Smith’s holding that there was no expectation of privacy in the telephone metadata in that case because it had been voluntarily exposed to a third party, you can’t conclude there was an expectation of privacy in the metadata in this case.

The thing is that while people may voluntarily agree to hand over certain information to service providers (and it's safe to say the "agreement" is anything but "voluntary"), they do not naturally assume the service provider will share this -- no questions asked or warrants demanded -- with anyone else who comes asking for it. That's where the reliance on Smith v. Maryland fails. "Choose to disclose" is much different than "forced to disclose." And it's not as if it can truly be said phone users relinquish all ownership of that data. It's specifically tied to them and they "share" it with service providers -- which if that's how Litt wants to interpret the interaction, he should at least be honest and give both parties some sort of ownership, along with the privacy expectations that go with it.

A lot of the rest of it is given over to Litt's displeasure that courts have even granted plaintiffs standing in bulk metadata program lawsuits. Whatever the Third Party Doctrine doesn't shut down, the plaintiffs' inability to claim anything more than theoretical rights violations by programs the government refused to discuss publicly should have seen the cases tossed immediately. He agrees the framework is there for massive violations of privacy but these actually damaging acts simply never occurred. But abuses did occur and were covered up by the NSA, nearly resulting in the program being shut down back in 2008 by FISC Judge Reggie Walton.

This fact undercuts Litt's assertions in defense of the now-curtailed program.

For several years, and with judicial authorization, the NSA collected metadata in bulk about U.S. phone calls from telephone companies for counterterrorism purposes. The metadata was kept in secure databases. It could only be accessed by a few specially trained NSA analysts, and then only to identify telephone numbers in contact with so-called “seed” numbers as to which there was a reasonable and articulable suspicion of an association with terrorism—such as, for example, a number used by a suspected terrorist.

First off, the program was accessed by more than just a "few" specially trained analysts. It was a free-for-all until the FISA Court shut that down. Second, the reasonable, articulable suspicion standard wasn't always applied to searches of the database. For a period of time, NSA analysts ran searches against an "Alert List" of numbers the FISA Court had never approved for use -- i.e., no RAS declaration was made by the NSA to support additions to the list used for searches of the bulk data. Some of these numbers were added simply because they were two or three hops away from an RAS-supported number, meaning there was nothing supporting the use of these "connected" numbers as new "seeds" for database searches and contact chaining.

What Litt does get right is that the NSA has done itself no favors with its decades of opacity.

Where we fell short was on the third leg of the stool, transparency. There would have been less damage to the Intelligence Community from the disclosures of the last couple of years had we been more forthcoming about our activities before those leaks. Obviously, intelligence activities have to be conducted with some degree of secrecy, and the same is true of some law enforcement activities. Specific methods and targets of surveillance have to be protected. But if we don’t discuss what we are doing and how we are regulating it even in general terms, we cede the field to those who are hostile to intelligence activities.

And, perhaps inadvertently, Litt lets us know President Obama is just as big a fan of the NSA as his predecessor was.

A decision by Congress to authorize certain activities under certain controls, made after discussion and debate, should be a strong factor in support of the reasonableness of those activities. Congress is going to have a number of opportunities to address these issues. For example, Section 702 expires at the end of 2017, and there are continued efforts to modernize the Stored Communications Act. It may be too much to hope that in the current political environment, Congress could have a dispassionate and comprehensive discussion about such weighty issues, but the Executive Branch would welcome such a discussion.

Given the selection of presidential frontrunners, I have no reason to believe Litt's assessment of the situation will be any less accurate by the time the Section 702 expiration date rolls around.

Filed Under: 4th amendment, bulk surveillance, mass surveillance, nsa, odni, privacy, robert litt, surveillance, third party doctrine

Sixth Circuit Says Cell Site Location Data Just A Business Record; No Warrants Required

from the what-Smith-v.-Maryland-has-wrought dept

To date, four appeals courts have entered opinions on whether cell site location info is covered by the Fourth Amendment. So far, only the Fourth Circuit Court of Appeals has found this to be worthy of a warrant. All others find CSLI to be covered under the Third Party Doctrine. These cases all deal with historical cell site location info, usually obtained in bulk with subpoenas. Near real-time tracking using tower pings is another issue entirely -- one that's rarer because a) obtaining rolling CSLI from a provider is a pain and b) everyone's using Stingrays now.

The Sixth Circuit Court of Appeals is the fourth appeals court to find CSLI isn't covered by the Fourth Amendment. By this point, the arguments against greater privacy protections are all too familiar.

It's Just Metadata:

Content, per this distinction, is protected under the Fourth Amendment, but routing information is not.

It's not as precise as other tracking methods, so not really a problem:

The defendants argue that the government’s collection of those records constituted a warrantless search in violation of the Fourth Amendment. In making that argument, however, the defendants elide both the distinction described above and the difference between GPS tracking and the far less precise locational information that the government obtained here.

The amount of data gathered by the FBI is impressive. Relying on orders issued by three different magistrate judges, the FBI obtained 6-7 months of location info for 16 different cellphones. The coarse location info (accurate to within a half-mile in most cases) helped place two of the suspects near the scene of a couple of robberies. The suspects' attempt to suppress the evidence gathered by these orders made it all the way up the chain to the Appeals Court -- only to find the court affirm the lower court's denial of their motion.

The court quotes from 1979's Smith v. Maryland decision -- the cornerstone of a majority of pro-Third Party Doctrine arguments -- but fails to see any difference between obtaining call routing info tied to a non-mobile landline and information wholly unrelated to any communications generated by mobile phones as they connect to towers..

The court also quotes law enforcement's favorite argument: that people should know things they "share" involuntarily with cell providers are also things they involuntarily share with the government.

[A]ny cellphone user who has seen her phone’s signal strength fluctuate must know that, when she places or receives a call, her phone “exposes” its location to the nearest cell tower and thus to the company that operates the tower.

As in other cases dismissed using this same rationale, this representation of what people should or shouldn't know isn't just inaccurate (and highly dismissive of people who don't realize this give-and-take is part of cellphone operation) but it's also disingenuous. People likely know they generate some sort of location information. What they don't assume is that law enforcement can access records of their movements without a warrant.

The opinion also name-drops the Stored Communications Act -- part of the abysmal Electronics Communication Privacy Act -- as part of the reason the court won't be extending an expectation of privacy to location data.

Some other points bear mention. One is that Congress has specifically legislated on the question before us today, and in doing so has struck the balance reflected in the Stored Communications Act. The Act stakes out a middle ground between full Fourth Amendment protection and no protection at all, requiring that the government show “reasonable grounds” but not “probable cause” to obtain the cell-site data at issue here. See 18 U.S.C. § 2703(d). The defendants and the ACLU effectively ask us to declare that balance unconstitutional. There is considerable irony in that request. The Katz standard asks whether the defendants’ asserted expectation of privacy “is ‘one that society is prepared to recognize as reasonable[.]’” Smith, 442 U.S. at 740 (quoting Katz, 389 U.S. at 361). Here, one might say that society itself—in the form of its elected representatives in Congress—has already struck a balance that it thinks reasonable.

Hardly. The ECPA is a farce -- one that the government has used for years to obtain communications in bulk without a warrant.

Now, as to the lowered bar for obtaining CSLI -- a proxy version of location tracking -- historical data, especially one as "coarse" as CSLI is likely not going to be found to be worthy of Fourth Amendment protection… at least not by the courts. (Even in the Fourth Circuit decision, the concern was about the quantity of records obtained, rather than that they were obtained without a warrant.) As the opinion somewhat notes in its nod to Congress, this is an issue that needs to be addressed by legislation that more accurately reflects the privacy expectations of the public. The Stored Communications Act does not.

But courts do need to be wary of relying on Smith v. Maryland and constantly deferring to the Third Party Doctrine. Even in its coarse, historical form, CSLI reveals far more about a person's movements than law enforcement could obtain through any other warrantless method than following suspects in person. Law enforcement should not be prevented from availing themselves of technological advances, but the benefits need to be balanced against the public's expectations of privacy in records generated and collected as a result of phone usage.

Certainly, no one objects to pen registers for call routing data, but people honestly do not consider themselves to be nothing more than massive databanks the government can dip into with the most minimal of court oversight. Given the fact that many law enforcement agencies are deploying cell site simulators under the cover of pen register orders, the new normal should be an expectation of privacy in involuntarily-generated location data. Law enforcement likely finds coarse location data to be accurate enough for indictments and prosecutions and the continued denial of Fourth Amendment protection only encourages them to obtain CSLI with a court order rather than clear the higher evidentiary hurdles presented by the use of GPS devices.

Unfortunately, without Congressional action, most courts can only rely on legal precedent -- and the bulk of it considers parties generated by members of the public but collected and stored by companies to be unprotected by the Fourth Amendment. The only thing that's going to take Smith v. Maryland off the judicial table is new legislation or a Supreme Court decision declaring location data to have an expectation of privacy. The former seems almost as likely as the latter, but neither can truly be considered inevitable.

Filed Under: business records, cell site location, csli, sixth circuit, third party doctrine, warrants

Another Federal Judge Says No Expectation Of Privacy In Cell Site Location Info Because Everyone Knows Phones Generate This Data

from the because-TV-shows-about-cops dept

In the Seventh Circuit -- where there's currently no Appeals Court precedent on cell site location info (CSLI) -- federal judge Pamela Pepper has decided only about half of what other courts have said about this info's expectation of privacy applies. That would be the half that finds the Third Party Doctrine covers cell phones' constant connections to cell towers. (via FourthAmendment.com)

Three circuits (4th, 5th and 11th) have ruled on whether obtaining CSLI from providers constitutes a search or seizure under the Fourth Amendment. Only the Fourth found that this information deserved greater privacy protections, mainly because of the ubiquitousness of cell phones. The other two held that CSLI is just another business record, even if it is the sort of business record that generates a detailed history of someone's movements and can be used to track someone in near real-time.

The Supreme Court also had something to say about the long-term tracking of people's movements in its decision about GPS tracking devices. While not exactly the same thing, it was close, and the court here examines this decision as well. The government suggested long-term location tracking might have enough Fourth Amendment implications to justify a warrant requirement, but stopped short of making that call.

With these non-precedents in hand, Judge Pepper finds there's no expectation of privacy in cell location info because -- like the government has argued in other cases -- everyone should know their phones are acting as ad hoc government tracking devices.

This court disagrees that today, when many Americans own some sort of cell phone and carry it frequently, an individual’s expectation that the government could not track his whereabouts over time is reasonable. The media is rife with information—and sometimes warnings—about the fact that one’s location can be tracked from one’s cell phone.

[...]

Popular culture promotes the notion that the government, too, can determine extensive information about an individual from, among other things, one’s phone. In 2013, the news was filled with former National Security Agency contractor Edward Snowden’s revelations regarding the extent to which the NSA allegedly was collecting phone metadata without warrants or court orders; controversy continues regarding whether such a practice was justified, necessary or lawful.

As long ago as 2004, the popular HBO series “The Wire” devoted an episode to the use of the disposable prepaid cell phones used by the drug-dealing characters in the show.

Because of the pervasiveness of this info, Judge Pepper argues that everyone show know that cell phones generate location data and that the government can access this information without a warrant. The first assertion is likely true. People are mostly aware that their phones connect with cell towers and that they're constantly being asked by websites for permission to use their location info, etc. But it's not likely true that most Americans are aware these records can be obtained without a warrant.

The two media references the judge uses to back her claim that cell phone users must be aware the government can obtain location data have nothing to do with location data. Both only deal with the government's warrantless acquisition of numbers dialled and received. Snowden's first revelations dealt with the collection of phone records from Verizon. In The Wire, drug dealers used burner phones not because they didn't want law enforcement to know where they were, but so the numbers dialled and received couldn't be tracked and their calls couldn't be wiretapped -- the latter of which requires a warrant. Even her statement that police TV shows have long shown officers determining someone's location by "triangulating signals" is a false equivalent, as that method requires officers on the move attempting to locate one person at a specific time -- which is nothing like obtaining weeks or months-long records of their travels.

Judge Pepper finds the Fourth Circuit's finding baffling, but only because she frames this as a logical leap all cell phone users should have made: that what they share with phone companies is also shared with the government.

This court also is puzzled by the Graham court’s assertion that an individual has a reasonable expectation of privacy in cell tower data because she does not know which cell towers transmit the communications, or where they are located. Cell users know that they need to be in some sort of proximity to a tower in order to have cellular service. Those who drive specific routes each day to work know well the spots where they’re likely to lose service, and where they will regain it. Subway riders know why they lose service when they enter the tunnels. Perhaps cell users do not know, at the moment they discover that they have reception, where the tower is located. But users of cell phones know, at all times, that if their phone is connected to a network, they’re in some kind of proximity to a tower, and that if it is not connected, they likely aren’t.

Again, this says nothing about whether the average person believes their interactions with their service providers are just between these two parties. The government usually isn't considered to be interchangeable with the third parties people enter into voluntary relationships with. Knowing that you must be connected to a cell tower to make calls or use data is not the same thing as knowing the government can obtain this information with little to no difficulty/paperwork.

In decisions like these, the "reasonable expectation of privacy" is based solely on what the government feels is "reasonable" -- far removed from the average citizen's view of what is "reasonably" private information.

Filed Under: csli, privacy, third party doctrine

Senator Wyden Lays Out New 'Compact For Privacy & Security In The Digital Age' In Response To Surveillance/Encryption Fights

from the something-to-get-behind dept

Yesterday, at the excellent RightsCon event in San Francisco, Senator Ron Wyden gave a barn burner of a speech, in which he detailed why it was so important to protect our privacy and security in a digital age, at a time when law enforcement and the intelligence communities are digging deeper and deeper into all of our personal information. He started out with a clear and emphatic statement on how he will block any attempt by Congress to undermine encryption:

I am here to tell you why I will use every power I have as a senator to block plans to weaken strong encryption. I am here to tell you why FBI Director Comey’s plans and expected legislation will be a lose-lose - they would lead to less security and less liberty

Furthermore, he made it clear that anyone who says that this just a debate between privacy and security has it totally wrong:

And let me be clear at the outset that the debate about data security is not about choosing security or choosing privacy. It is about choosing less security or choosing more security. People who think that the government should have more surveillance powers will often try to frame this debate as a choice between privacy and security. They are wrong. Our job is to convince the public that when politicians or the news media say that, we are here to tell you it’s not the case. It’s less security versus more security.

He further pointed out that, contrary to the claims of James Comey and others in law enforcement, this is the "golden age of surveillance" in that modern technologies have given law enforcement much more access to private information than they've ever had before. And he compared the freakout claims from law enforcement to similar claims 50 years ago, when the Supreme Court ruled in Miranda v. Arizona that law enforcement had to read people their rights -- and law enforcement and the media insisted this would lead to much more criminal activity:

I think that it is useful to compare this discussion to another one that was playing out fifty years ago. Fifty years ago this summer, the Supreme Court handed down a landmark decision in the case of Miranda vs. Arizona, in which the Court ruled that before law enforcement officers interrogate a suspect, they must advise that person of his or her constitutional rights. Everyone who’s ever watched a TV cop show knows this – you have the right to remain silent, you have the right to an attorney, and so forth. Today, this is a very important feature of the American justice system. It helps ensure that poor people know that they have the same rights under the law as rich people who can afford high-priced lawyers. And it helps reduce the likelihood of innocent people who are unsure about their rights being pressured to sign false confessions. The Miranda ruling helped bring our country closer to the promise of equal justice for all.

But if you had been following the public debate back in the summer of 1966, you would have heard a lot of politicians and prosecutors saying that the sky was falling. A few weeks after the decision, a New York Times headline read “Miranda Decision Said to End Effective Use of Confessions.” The article quoted some of the most respected prosecutors and law enforcement officials in the country warning that this decision was an absolute catastrophe. Future president Richard Nixon called the ruling a “Dickensian legalism” that would “hamstring” law enforcement, and he even suggested that the Constitution should be amended to overturn it.

Needless to say, the sky did not fall. In fact, crime rates have been dropping for the past twenty or thirty years. The national murder rate and burglary rate are both lower than they were the day that the Miranda ruling was handed down. Obviously there are a lot of factors that go into crime rates, but I think it’s clear that despite all of the dire warnings from both politicians and respected law enforcement officials, this ruling did not lead to the end of law enforcement in America. Fifty years later, the Miranda ruling remains a cornerstone of American due process.

From there, he announced what he's calling a new "Compact for Privacy and Security in the Digital Age" with four key prongs:

• Protecting strong encryption to safeguard Americans’ private data. Wyden’s Secure Data Act would ban the government from forcing companies to build backdoors or otherwise weaken the security of their products.
• Overhauling the Third Party Doctrine to make clear individuals do not lose their privacy rights just because they share some of their personal information with a particular company.
• Increasing transparency by holding at least three congressional hearings each year on the privacy impacts of surveillance laws, authorities and practices.
• Being on high alert for fresh attempts to undermine checks on government power. Right now the Justice Department is seeking a change to the rules for getting warrants to track computer hackers that would allow DOJ to use a single warrant to remotely access any computer that a suspected hacker is believed to have broken into. This rule change could potentially allow federal investigators to use a single warrant to access millions of computers, and it would treat the victims of the hack the same as the hacker himself.
• Finally, the government must do much more to hire people who understand technology and the implications of weakening digital security and privacy.

He spent some time in his speech blasting the concept of the third party doctrine and how ridiculous it is in practice:

Here’s the problem. A few decades ago, courts began ruling that if you provide information to a third party, like your bank or your phone company, you are no longer keeping it private, and it is no longer protected under the Fourth Amendment to the Constitution.

There is a huge, glaring problem with that logic. When you share your information with a single private company, that is not the same thing as making it public. Your phone company may have records of who you call, and your bank may have records of how you spend your money, but your contract with them will have rules for when and how they are allowed to share that information. They are not allowed to just disclose it freely.

This is true in the digital world as well. When I post a handsome new profile picture on Facebook, or send out a tweet to tell people that I’m holding a town hall in Oregon, I’ve chosen to make that information public. But when I send an email to my wife, or store a document in the cloud so I can work on it later, my service provider and I have an agreement that my information will stay private. The premise in current law is that I have agreed to make that information public just because my service provider is holding it. And that premise is simply absurd.

It's yet another great speech on an important topic from Senator Wyden -- and he includes a call to action to get people who support this vision to speak out on it. As it stands right now there are a few others in Congress who get how important all of this is, but many do not. And that needs to change. And while many people will be quite cynical about this and say that we'll never get others in Congess to recognize this issue, Senator Wyden reminded everyone that many people had the same view about SOPA/PIPA and the public eventually shifted Congress' position on that as well:

We can win this fight for security and liberty. It obviously won’t be easy, but we’ve done it before. Remember in the January of 2012, we were talking about the anti-Internet SOPA and PIPA bills. The first vote was on whether to override my hold on PIPA. Talk about long odds. The Chamber of Commerce, Hollywood, all the powerful special interests were against us. When that debate started, no one gave us a chance. Then the Internet community mobilized. Websites went dark in protest. And when the dust settled, well, everyone here knows how that ended. We won. Let’s work together and do it again.

While I do worry about the tendency of some to always roll out the "SOPA example" as proof, it is true that when enough people speak up, all the lobbyists and money in the world can be defeated. And this is a time when it would be nice to see that happen again.

Filed Under: compact for privacy & security, encryption, fbi, going dark, james comey, privacy, ron wyden, security, third party doctrine

Federal Judge Says Third Party Doctrine A Perfectly 'Good Law;' No Warrants Needed To Obtain Cell Location Records

from the multiple-government-agencies-agree! dept

Back in December, a Connecticut state court ruled that tracking people in near-real time with cell site location info required the use of a warrant. Three months later, a Connecticut federal court has ruled law enforcement can obtain CSLI without a warrant, in bulk and for extended periods of time. While the opinion doesn't address the use of subpoenas and CSLI as a makeshift Stingray (for real-time tracking), it does come down firmly on the side of the government's interpretation of the Third Party Doctrine.

Here, the Government acquired information about defendant that was in the possession of a third-party—Verizon—and that the acquisition of this information did not involve any trespass upon defendant’s body, house, papers, or effects and did not involve any interference at all with defendant’s possessory interests in any of his property.

The opinion leans heavily on every decision finding that there's no expectation of privacy in records held by third parties. The court makes the slightest nod to the current discussion of expectations of privacy in a world where the devices most people carry generate a wealth of information and data nearly non-stop. But it does so with wording that shows it has no interest in engaging in this discussion.

The third-party doctrine has been subject to tsunamis of criticism. But it doubtlessly remains good law today.

And, like other decisions along the same lines, the court echoes the government's assertions that every cell phone user is perfectly aware their phones are sending all sorts of information to the nearest cell tower.

Defendant also contends that cell-site location information is not voluntarily conveyed to one’s cellular telephone company in the same sense or manner that one voluntarily conveys financial information to a bank as in Miller or telephone numbers to a telephone company as in Smith. Although this rationale has convinced some courts to conclude that the third-party doctrine does not apply, I do not agree. Every cell phone customer knows that his or her information is relayed wirelessly to nearby cell phone towers. It can come as no surprise that one’s cell phone company keeps records of cell towers that are accessed by and necessary to the provision and connection of every customer’s cell phone service. This is no different than every customer’s awareness that the bank keeps records of one’s checks and transactions (Miller) and that the telephone company keeps records of the telephone numbers that one calls (Smith).

The court also points out there's no bright line determination as to how much is too much when it comes to acquiring location records. (The defendant raised the argument that 22 days of CSLI was excessive without the use of a warrant.) As the court logically points out, any determination on an acceptable time frame would be completely arbitrary and mostly useless.

As for the Third Party Doctrine's possible inapplicability in today's world, the court says that's up to Congress to fix, not the courts.

All that said, the critics of the third-party doctrine have strong arguments it does not adequately protect privacy—that it imposes an unacceptable and Orwellian cost of forfeiture of any claim of privacy to what we voluntarily disclose even in confidence to one another. The critics persuasively argue that the doctrine is especially problematic in our ever expanding technology-dependent and technology-intrusive society. But these are arguments for policymakers in Congress to consider, if Congress wishes to enact protections that exceed the Fourth Amendment baseline.

[...]

In the meantime, the obligation remains for the lower courts to follow the law and not to impose—no matter how techno-intellectually fashionable—an “everything is different because it’s an iPhone” theory of the Fourth Amendment.

The issue of real-time warrantless tracking remains unaddressed as this case only dealt with historic data. The question of the Third Party Doctrine is punted back to Congress -- which has proven mostly uninterested in updating outdated laws to better conform to today's reality. Even with a boot up the ladder to a higher court is unlikely to result in a re-reading of the Third Party Doctrine. The Supreme Court has only determined that long-term location tracking might need a warrant. As it stands now, the acquisition of third-party records violates no one's privacy, legally-speaking.

Filed Under: 4th amendment, cell site location info, connecticut, csli, mosaic theory, privacy, third party doctrine

Prosecutors Argue Cell Site Location Data Is Something Every User Shares With 'The Rest Of The World'

from the no-expectation-of-privacy-in-things-we-insist-everyone-knows dept

The state of Maryland's defense of the Baltimore PD's warrantless use of Stingray devices continues, taking the form of a series of motions unofficially titled Things People Should Know About Their Cell Phones.

The last brief it filed in this criminal prosecution claimed "everyone knows" phones generate location data, therefore there's no expectation of privacy in this information. As commenters pointed out, people may know lots of stuff about records they're generating, but that doesn't mean law enforcement should have warrantless access to those records.

Everyone Knows… That my Doctors generate medical data about patients, so how about we get their medical records on public display without warrants!

With no expectation of privacy, there's no need for a warrant. And with no warrant requirement, there's no chance of having evidence tossed. That's a win Maryland needs, considering the Baltimore PD alone has deployed IMSI catchers several thousand times without obtaining warrants. Everything runs through pen register orders, which both lower the burden of proof and (in many cases) obscure the technology actually being used.

Now, it's back with its response to the defendant's motion to dismiss and it's again claiming People Know Stuff, therefore no expectation of privacy. (h/t Brad Heath)

After dismissing the defendant's arguments about police use of location tracking devices as "dystopian fantasies," the state argues it's time for the accused (not just this one, but any others facing prosecutions predicated on warrantless cell phone tracking device usage) to stop pretending they don't know how much data their phones are coughing up.

While cell phones are ubiquitous, they all come with "off" switches. If a cell phone is turned on, it is receiving signals from cell towers, and sending signals back out to cell towers. The cell site simulator used in this case took advantage of that fact in order to locate Andrews's phone. Because Andrews chose to keep his cell phone on, he was voluntarily sharing the location of his cell phone with third parties. Under the doctrine set forth by the Supreme Court in Smith, supra, he cannot claim a Fourth Amendment privacy right in this case.

The "Smith" the state refers to is 1979's Smith v. Maryland, which law enforcement loves to use in cell phone surveillance cases, because:

a) it's incredibly outdated, and
b) it provides a very broad and favorable reading of the Third Party Doctrine as it relates to phone usage.

The state says it's the defendant's own fault he was located. After all, he had a choice. And he chose badly.

Andrews complains that the police "invaded" a "constitutionally protected area," and therefore this search triggered Fourth Amendment protections under United States v. Karo, 468 U.S. 705 (1984) and Kyllo v. United States, 533 US. 27 (2001). But in Karo, the suspect was unaware that he had brought a police transponder into his home, and in Kyllo, the suspect was unable to prevent grow-lights (or his body) from emitting heat. Andrews, by contrast, was quite aware that he was bringing his own cell phone into the house. And he was quite capable of turning it off

The government's argument, while technically solid when used in conjunction with these precedent-setting decisions (Smith's outdated view of phones notwithstanding), but it becomes completely disingenuous when it describes the "sharing" of identifying phone data.

Just as the telephone company in Smith used transmitted phone numbers in a way quite distinct from the way in which the police used them, so, too, Andrews's cell service provider used the ID number broadcast by his cell phone in ways quite distinct from the way in which the police used it. The way in which the information was used does not alter the "expectation of privacy" in the information itself. Smith controls here. Andrews's addition of the adjective "exact" to the noun "location" does not alter that fact. The issue is not whether Andrews was aware that the police could find the location of his cell phone to within 20 yards. The issue is whether Andrews can claim an objectively reasonable expectation of privacy in information which he was voluntarily broadcasting to third parties at all times. Under Smith, the answer is no.

There is no Fourth Amendment right to evade a valid arrest warrant. Andrews was wanted on multiple counts of attempted murder. A life "on the lam" may require some inconveniences, such as not staying in one's home, and turning one's cell phone off when not in use. There is no constitutional right to avoid being arrested for one's crimes, and nothing unreasonable about the police using the same information that Andrews was sharing with the rest of the world to apprehend him.

The "rest of the world?" Really? Andrews may have been able to talk his cell phone provider into turning over a copy of all the data his phone had generated, but it's not as though the general public has access to this information, expectation of privacy or no. Just because law enforcement can access this information with warrants or (more likely) pen register orders does not make it information "shared" with "the rest of the world." It is not shared indiscriminately and it's only because cell providers are legally compelled to cooperate with law enforcement (CALEA, etc.) that cops can obtain this information with a pen register order, rather than a warrant.

And, in this case, the information was not obtained with a court order. There may be a court order on record that would give the impression the BPD would approach a telco for phone records, but the actual collection of Andrews' location info was done with a Hailstorm cell tower spoofer. The state claims the request specified the use of a cell tower spoofer but there's no indication the presiding judge had any idea how much information these devices can obtain. A pen register order refers to a targeted phone number. A cell tower simulator gathers information from everyone in the area.

This isn't just a fight over this particular prosecution. This is the state safeguarding its thousands of Stingray deployments. If it's going to be able to keep those prosecutions from falling apart -- now that the BPD's devices are an open secret -- it needs the court to agree there's no expectation of privacy in cell phone location data. And in order to do that, it apparently needs the court to believe everyone using a cell phone is sharing all sorts of information with "the rest of the world."

Filed Under: 4th amendment, baltimore, expectation of privacy, location, location data, maryland, privacy, third party doctrine

Judge Kavanaugh, Dragnet Fan From Way Back, Shoots Down Section 215 Rehearing With Extraneous Surveillance Boosterism

from the NSA!-NSA!-NSA!-NSA!-[performs-'Wave'-by-himself] dept

Once upon a time, a DC district court judge found the NSA's bulk phone metadata collection to be a violation of the Fourth Amendment. Wailing, gnashing of teeth and a round of appeals ensued.

Nearly two years later, this judge (Richard Leon) reiterated his position after the appeals court overturned his decision. Judge Leon again issued an injunction preventing the NSA from collecting the phone records of two of the plaintiffs. This too was almost immediately stayed following the government's swift appeal.

One of the plaintiffs not included in Leon's injunction was Larry Klayman. Klayman petitioned the appeals court for an en banc rehearing of its decision to stay Leon's order. The court has turned him down. But rather than simply turn Klayman down with a single paragraph noting the denial of his request, Judge Brett Kavanaugh took it upon himself to pen a full-throated defense of the NSA's bulk metadata collection.

I vote to deny plaintiffs’ emergency petition for rehearing en banc. I do so because, in my view, the Government’s metadata collection program is entirely consistent with the Fourth Amendment. Therefore, plaintiffs cannot show a likelihood of success on the merits of their claim, and this Court was right to stay the District Court’s injunction against the Government’s program.

The Government’s collection of telephony metadata from a third party such as a telecommunications service provider is not considered a search under the Fourth Amendment, at least under the Supreme Court’s decision in Smith v. Maryland, 442 U.S. 735 (1979). That precedent remains binding on lower courts in our hierarchical system of absolute vertical stare decisis.

Even if the bulk collection of telephony metadata constitutes a search, cf. United States v. Jones, 132 S. Ct. 945, 954-57 (2012) (Sotomayor, J., concurring), the Fourth Amendment does not bar all searches and seizures. It bars only unreasonable searches and seizures. And the Government’s metadata collection program readily qualifies as reasonable under the Supreme Court’s case law. The Fourth Amendment allows governmental searches and seizures without individualized suspicion when the Government demonstrates a sufficient “special need” – that is, a need beyond the normal need for law enforcement – that outweighs the intrusion on individual liberty. [...] The Government’s program for bulk collection of telephony metadata serves a critically important special need – preventing terrorist attacks on the United States. See THE 9/11 COMMISSION REPORT (2004). In my view, that critical national security need outweighs the impact on privacy occasioned by this program. The Government’s program does not capture the content of communications, but rather the time and duration of calls, and the numbers called. In short, the Government’s program fits comfortably within the Supreme Court precedents applying the special needs doctrine.

Kavanaugh makes these assertions about "special needs" and claims the government's metadata program is instrumental in preventing terrorist attacks, despite no intelligence official ever having presented evidence that supports this assertion.

While it isn't unusual to see judges align themselves with the government's "special needs" in cases where counterterrorism efforts are implicated, it's a bit strange to see a judge step up, unbidden, to tell a plaintiff that, in no uncertain terms, as long as he's wearing the robe, no one's going to be questioning the constitutionality of the NSA's national security efforts.

But why would Kavanaugh feel so compelled to defend dragnet surveillance efforts, especially one that's becoming much less of a dragnet in the near future? Marcy Wheeler has the answer:

Kavanaugh, of course, served as a White House lawyer and as Staff Secretary during the period when George Bush kept self-authorizing such a dragnet.

[...]

[A]s people cite from this language in the future, they should remember that of all the judges who reviewed this decision, only Kavanaugh had this kind of personal tie to the dragnet. And only Kavanaugh saw fit to weigh in.

Klayman, along with other plaintiffs and Judge Richard Leon, have questioned the asserted "cuteness" of Kavanaugh's baby. And Kavanaugh apparently is not about to let that slide. So, we get an en banc denial with several paragraphs of Kavanaugh's surveillance state boosterism needlessly attached.

Filed Under: 215, 4th amendment, brett kavanaugh, bulk data, dc, larry klayman, nsa, surveillance, third party doctrine