Canadian Supreme Court Says Government Needs To Get A Warrant To Get Your Internet Info

from the big-win-for-privacy dept

While we're still struggling with this stuff down here in the US, the Canadian Supreme Court made a huge decision earlier today, saying that the government must get a warrant to demand your information from an internet provider. In other words, your information is private, even if it's held by an internet company. The full ruling in this case, R. v. Spencer is worth reading, but the key finding is that there is an expectation of privacy in this information, and thus, searching it requires a warrant:

In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

As Michael Geist points out, not only does this mean ISPs now need to change their procedures, but also (importantly) it should destroy the rationale for two new attempted bills concerning "legal access" (i.e., expanding the government's ability to get information via internet service providers without a warrant). This kind of ruling should fit equally at home with the 4th Amendment here in the US, but the issue still really hasn't been tested at the Supreme Court. Congrats up north, though, for actually recognizing the value of a warrant and just a bit of oversight on government surveillance.

Filed Under: canada, expectation of privacy, internet info, privacy, supreme court, third party doctrine, warrants

Appeals Court Says Using Open WiFi May Be A Crime

from the uh-oh dept

For many years, we've had ongoing debates about whether or not it's ethical or legal to use open WiFi connections. It's one of those debates that never seem to stop. Unfortunately, in a ruling yesterday, the Third Circuit appeals court suggested that merely using an open WiFi network may be a criminal act. This is hugely problematic for a variety of reasons.

The case is mainly about the question of whether or not police need a warrant to track down someone connecting to a neighbor's open WiFi. In fact, on first reading it, I had thought that I'd lump it in with yesterday's big victory for the 4th Amendment in the 11th Circuit, saying that police need to get a warrant for mobile phone location. The main thrust of this new ruling is that police do not need a warrant to use a tool called "MoocherHunter" to track down who is likely using someone else's WiFi. While I'm a big 4th Amendment fan, this ruling actually makes a fair bit of sense on that front, as I'll explain below. But eventually, it runs into serious trouble with some offhand comments towards the end.

In this case, police were trying to track down someone downloading and sharing child pornography via a P2P setup, and were able to track down the IP address. After visiting the residence associated with the IP address, the police quickly realized that no one in the house was the likely person involved with child porn (there was no child porn on the computers, nor the file sharing software with a matching user ID). From there, the police asked the residents to cooperate by installing "MoocherHunter" to try to track down who was actually connecting to their open router. It's worth noting that the police actually had a "lengthy discussion" with federal prosecutors over whether or not a warrant was needed for MoocherHunter first, and they concluded it wasn't needed.

Eventually, the results were narrowed down to the likely culprit, Richard Stanley, and the police then got a warrant to search that guy's apartment, leading him to confess (after first trying to run away). Stanley's computer also contained the child porn. Stanley tried to suppress the evidence, arguing that the use of MoocherHunter required a warrant, not unlike the Kyllo ruling that found that police needed a warrant to use a thermal imaging device from outside someone's house to detect if there was enough heat inside to support probable cause for growing marijuana. The court here notes that while, superficially, these may look similar (a device pointed at someone's residence), the reality is that they were quite different, because Kyllo was about looking inside someone's house to see what they were doing in the privacy of their own home, whereas MoocherHunter was about identifying someone who had reached out of their own home into someone else's space to make use of their WiFi connection.

Critical to Kyllo’s holding, however, was the fact that the defendant sought to confine his activities to the interior of his home. He justifiably relied on the privacy protections of the home to shield these activities from public observation. See Kyllo, 533 U.S. at 34 (characterizing the thermal imaging scan as a “search of the interior of [Kyllo’s] home[],” which it considered to be “the prototypical . . . area of protected privacy”). See 13 also id. at 37 (“In the home, our cases show, all details are intimate details, because the entire area is held safe from prying government eyes.”) (emphasis in original).

Stanley can make no such claim. Stanley made no effort to confine his conduct to the interior of his home. In fact, his conduct—sharing child pornography with other Internet users via a stranger’s Internet connection—was deliberately projected outside of his home, as it required interactions with persons and objects beyond the threshold of his residence. In effect, Stanley opened his window and extended an invisible, virtual arm across the street to the Neighbor’s router so that he could exploit his Internet connection. In so doing, Stanley deliberately ventured beyond the privacy protections of the home, and thus, beyond the safe harbor provided by Kyllo....

The court further emphasizes that since MoocherHunter only revealed the path, but not the content, Stanley has even less privacy interest. That all makes some amount of sense. The court then has an interesting discussion about the third party doctrine, and whether or not Smith v. Maryland applies to Stanley's signals. In this case, it concludes it does not. And while the reasoning is a bit convoluted, this seems important:

Were we to hold that Stanley exposed his “signal” under Smith by transmitting it to a third-party router, we might open a veritable Pandora’s Box of Internet-related privacy concerns. The Internet, by its very nature, requires all users to transmit their signals to third parties. Even a person who subscribes to a lawful, legitimate Internet connection necessarily transmits her signal to a modem and/or servers owned by third parties. This signal carries with it an abundance of detailed, private information about that user’s Internet activity. A holding that an Internet user discloses her “signal” every time it is routed through third-party equipment could, without adequate qualification, unintentionally provide the government unfettered access to this mass of private information without requiring its agents to obtain a warrant. We doubt the wisdom of such a sweeping ruling, and in any event, find it unnecessary to embrace its reasoning.

That's a very good ruling. But, then, suddenly, the ruling goes off the rails, saying that merely connecting to the open WiFi itself may have been a criminal act:

The presence of Stanley’s signal was likely illegal. A large number of states, including Pennsylvania, have criminalized unauthorized access to a computer network. A number of states have also passed statutes penalizing theft of services, which often explicitly include telephone, cable, or computer services. We need not decide here whether these statutes apply to wireless mooching, but the dubious legality of Stanley’s conduct bolsters our conclusion that society would be unwilling to recognize his privacy interests as “reasonable.”

Yikes. While the court acknowledges in a footnote that this issue is somewhat contested, it's incredibly problematic in general. Just the idea that this is unauthorized access is a big problem, because it's not unauthorized. The neighbors left their WiFi open, and thus, by default, it is sending out signals that effectively say "welcome, feel free to connect to this network." It is authorized by the very nature of the setup of the network. Thus, it's quite questionable to argue that this is either unauthorized access or "theft of services." The court doesn't even seem to consider this. And while this part is not central to the overall ruling, it is still quite troubling to have that on the record in an appeals court ruling.

Filed Under: 3rd circuit, 3rd party doctrine, 4th amendment, kyllo, moocherhunter, mooching, open wifi, richard stanley, warrants, wifi

Microsoft Challenges Idea That US Government Can Go Fishing For Emails Stored Outside The US

from the going-to-be-an-important-fight dept

Back in April, we wrote about a magistrate judge ruling that Microsoft had to comply with a warrant asking for data that was held on servers in Dublin. Microsoft argued, quite reasonably, that a US warrant doesn't apply outside of the US. Unfortunately, magistrate judge James Francis disagreed, saying that while it's true that traditional warrants only apply inside the US, this is different because it's "digital." He argued that because the issue was about information, rather than physical property, it could be considered more like a subpoena than a warrant. As we noted, Microsoft made it clear that it would challenge this ruling, and now it has done so, arguing that the ruling flies in the face of the law and the Constitution. This summary from Microsoft's filing is pretty clear on what an incredibly big deal this is, with the government basically seeking to get the best of a subpoena and a warrant without any of the protections and limits required of either:

The Magistrate Judge issued a warrant under the Electronic Communications Privacy Act ("ECPA") that on its face, purports to authorize the Government to search any and all of Microsoft's facilities worldwide. Microsoft moved to vacate the warrant because the private email communications the Government seeks are located in a Microsoft facility in Dublin, Ireland and because Congress has not authorized the issuance of warrants that reach outside U.S. territory. The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad. To end-run these points. the Government argues, and the Magistrate Judge held, that the warrant required by ECPA is not a "warrant" at all. They assert that Congress did not mean "warrant" when using that term, but instead meant some previously unheard of "hybrid" between a warrant and subpoena duces tecum. The Government takes the extraordinary position that by merely serving such a warrant on any U.S.-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located. and without the knowledge or consent of the subscriber or the relevant foreign government where the data is stored.

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

Verizon has stepped in as well, pointing out that if the original ruling is allowed to stand, it could have significant negative impact on the ability of US businesses to get non-US users to trust them -- an increasingly important issue in light of the Snowden revelations.

The magistrate’s ruling, if left standing, could cost U.S. businesses billions of dollars in lost revenue, undermine international agreements and understandings, and prompt foreign governments to retaliate by forcing foreign affiliates of American companies to turn over the content of customer data stored in the United States.

The recent revelations about U.S. intelligence practices have heightened foreign sensitivities about the U.S. government’s access to data abroad, generated distrust of U.S. companies by foreign officials and customers, and led to calls to cease doing business with U.S. communications and cloud service providers. Studies have estimated that this distrust will result in tens of billions of dollars in lost business over the next few years. The magistrate’s ruling, if left standing, will dramatically increase the harm to American businesses. It would mean that foreign customers’ communications and other stored data would be available to hundreds or thousands of federal, state, and local law enforcement agencies, regardless of the laws of the countries where the data is held. Foreign customers will respond by moving their business to foreign companies without a presence in the United States.

If you hadn't figured it out by now, this case is going to have tremendously important ramifications for privacy around the globe.

Filed Under: doj, ecpa, email, international, james francis, magistrate judge, privacy, sca, subpoena, warrants
Companies: microsoft

One More Benefit From Snowden: Companies No Longer Lulled Into Helping NSA Without Legal Basis

from the sunshine-does-amazing-things dept

One of the earliest Snowden revelations wasn't just that the big telcos were closely cooperating with the NSA, but that they had sometimes proactively volunteered to hand over much more information than the law required. So far, there has not been any evidence that tech/internet companies were quite so cooperative, but it does seem clear that many were, at the very least, incurious concerning what the NSA was up to and somewhat apathetic concerning actual requests that came in from the NSA. While there were a few companies (not many) that appeared to push back in a few circumstances (again, not many), for the most part, when someone from the federal government showed up with requests, companies were pretty quick to comply.

To some extent, you can understand why: not only is it easy to assume that government officials demanding information from you have some sort of serious reason for doing so, all of it happened in secret -- meaning that the "benefits" to pushing back often seemed slight, while the costs could be tremendous.

Ed Snowden changed that cost-benefit equation in a big, big way.

And it's most obvious in this simple way: companies are now proactively doing everything possible to counteract the NSA, realizing that they actually have to think about the impact on their customers when (not if) these programs become public. What used to be a simple relationship, with a lot of help from various companies, has changed to something much more approaching a directly adversarial relationship.

As fast as it can, Google is sealing up cracks in its systems that Edward J. Snowden revealed the N.S.A. had brilliantly exploited. It is encrypting more data as it moves among its servers and helping customers encode their own emails. Facebook, Microsoft and Yahoo are taking similar steps.

After years of cooperating with the government, the immediate goal now is to thwart Washington — as well as Beijing and Moscow. The strategy is also intended to preserve business overseas in places like Brazil and Germany that have threatened to entrust data only to local providers.

[....]

A year after Mr. Snowden’s revelations, the era of quiet cooperation is over. Telecommunications companies say they are denying requests to volunteer data not covered by existing law. A.T.&T., Verizon and others say that compared with a year ago, they are far more reluctant to cooperate with the United States government in “gray areas” where there is no explicit requirement for a legal warrant.

There is still a long way to go, but just the fact that companies now have to take into account "how will this look when splashed across the internet" means that they're already going much, much further in protecting the privacy of their users and customers.

Filed Under: companies, ed snowden, nsa, surveillance, voluntary assistance, warrants
Companies: at&t, facebook, google, microsoft, verizon, yahoo

Vodafone Reveals Government Agencies Have Direct Access To Its Network Around The World, No Warrants Required

from the even-worse-than-we-thought dept

One of the important results of Snowden's leaks over the last year is that the companies involved are not only becoming more open about how their services have been used by the NSA and GCHQ to spy on people, but they are even starting to push for less intrusion and more transparency. The latest to provide important information about what has been going on is Vodafone, with some fairly shocking news, as reported by the Guardian:

Vodafone, one of the world's largest mobile phone groups, has revealed the existence of secret wires that allow government agencies to listen to all conversations on its networks, saying they are widely used in some of the 29 countries in which it operates in Europe and beyond.

The company has broken its silence on government surveillance in order to push back against the increasingly widespread use of phone and broadband networks to spy on citizens, and will publish its first Law Enforcement Disclosure Report on Friday. At 40,000 words, it is the most comprehensive survey yet of how governments monitor the conversations and whereabouts of their people.

The company said wires had been connected directly to its network and those of other telecoms groups, allowing agencies to listen to or record live conversations and, in certain cases, track the whereabouts of a customer. Privacy campaigners said the revelations were a "nightmare scenario" that confirmed their worst fears on the extent of snooping.

The Guardian story has lots of new information, and is well-worth reading. It includes a table that shows the number of warrants issued last year for legal interception of content, on a country-by-country basis. There are some surprises here -- for example, the fact that the Australian government issued 685,757 warrants for metadata, which is even more than the UK's 514,608 warrants, despite the fact that Australia has well under half the population of the UK. There are other fascinating details in the Vodafone Law Enforcement Disclosure Report itself. For example, it contains this explanation about what exactly a warrant might encompass these days:

Each warrant can target any number of different subscribers. It can also target any number of different communications services used by each of those subscribers and -- in a modern and complex all-IP environment -- it can also target multiple devices used by each subscriber to access each communications service. Additionally, the same individual can be covered by multiple warrants: for example, more than one agency or authority may be investigating a particular individual. Furthermore, the legal framework in some countries requires agencies and authorities to obtain a new warrant for each target service or device, even if those services or devices are all used by the same individual of interest. Note that in the majority of countries, warrants have a time-limited lifespan beyond which they must either be renewed or allowed to lapse.

As people's digital lives grow more complex and the number of communications devices and services used at home and work on a daily basis continues to increase, the ratio of target devices and services accessed to warrants issued will continue to increase. To illustrate this with a hypothetical example:

a single warrant targets 5 individuals;

each individual subscribes to an average of eight different communications services provided by up to eight different companies: a landline phone line, a mobile phone, two email accounts, two social networking accounts and two "cloud"; storage accounts; and

each individual owns, on average, two communications devices fitted with a SIM card (a smartphone and a tablet) in addition to a landline phone and a laptop.

In the hypothetical example above, that one warrant could therefore be recorded as more than 100 separate instances of agency and authority access to individual services on individual devices used by individual subscribers.

That means that the number of warrants listed in the Vodafone report, and collected in the Guardian table mentioned above, is likely to be a significant underestimate of the total number of acts of surveillance being conducted. Alongside the main report, there is also an 88-page Legal Annexe (pdf):

This annexe to Vodafone's Law Enforcement Disclosure report seeks to highlight some of the most important legal powers available to government agencies and authorities seeking to access customer communications across the 29 countries of operation covered in this report.

Whilst the legal powers summarised here form part of local legislation in each of those countries and can therefore be accessed by the public, in practice very few people are aware of these powers or understand the extent to which they enable agencies and authorities to compel operators to provide assistance of this nature.

As that notes, very few people are aware of the powers that exist around the world, which makes this Annexe an extremely valuable contribution to charting the surveillance landscape, not least because it is being released freely. As well as for this research, Vodafone deserves credit for making the following call, as reported by the Guardian:

Vodafone's group privacy officer, Stephen Deadman, said: "These pipes exist, the direct access model exists.

"We are making a call to end direct access as a means of government agencies obtaining people's communication data. Without an official warrant, there is no external visibility. If we receive a demand we can push back against the agency. The fact that a government has to issue a piece of paper is an important constraint on how powers are used."

That's a hugely important point. Direct access, as revealed by Vodafone, not only allows governments real-time access to enormous quantities of private communications data, but does so in a way that hides the fact that the interception is taking place at all, even to the companies involved. As Vodafone notes, introducing the requirement for a warrant for all such interception would make it much easier for companies to resist, alert the public to the sheer scale of the surveillance being carried upon them, and probably act as a natural brake on governments. Direct access to the network represents a huge exacerbation of the dangers of government surveillance: it is simply too easy to "collect it all." Vodafone's disclosure report is an important step towards changing that; the "other telecoms groups" mentioned above should now follow suit by issuing their own.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: direct access, europe, surveillance, warrants, wiretaps
Companies: vodafone

Tech Companies Increasingly Telling Users When Law Enforcement Comes Asking For Data

from the good-for-them dept

In the past, we've noted that Twitter, alone among major tech companies, had made it a corporate policy to not just roll over when law enforcement came asking for user data, even alerting users that law enforcement was seeking their data, and giving them the chance to try to block the requests. Apparently, now a bunch of other big tech companies have started doing the same thing:

Google already routinely notified users of government data requests but adopted an updated policy this week detailing the few situations in which notification is withheld, such as when there is imminent risk of physical harm to a potential crime victim. “We notify users about legal demands when appropriate, unless prohibited by law or court order,” the company said in a statement.

Lawyers at Apple, Facebook and Microsoft are working on their own revisions, company officials said, although the details have not been released. All are moving toward more routinely notifying users, said the companies, which had not previously disclosed these changes.

“Later this month, Apple will update its policies so that in most cases when law enforcement requests personal information about a customer, the customer will receive a notification from Apple,” company spokeswoman Kristin Huguet said.

If you're looking for who to thank about this turn of events, there are two places to point. First: the good folks at EFF. For the past few years, it's been publishing its Who Has Your Back? chart looking at how companies respond to government requests for data. Each year, this list has convinced more and more companies to improve how they protect their users, and how they push back on government requests. And, the reason why so many companies are rushing to change their policies is because the EFF is about to release its latest version. Yet another reason to be happy the EFF exists.

Second, of course, is Ed Snowden. While not entirely directly at issue here -- since things like FISA Court Orders and National Security Letters are subject to gag orders barring companies from telling their users -- the generally heightened interest in government access to information provided to internet services has certainly created a culture where these companies can't get away with just rolling over for the government any more.

Of course, you could argue that it's taken these companies too long to get here -- and that's absolutely true -- but better late than never.

Oh yeah. Guess who's really upset about all of this:

The Justice Department disagrees, saying in a statement that new industry policies threaten investigations and put potential crime victims in greater peril.

“These risks of endangering life, risking destruction of evidence, or allowing suspects to flee or intimidate witnesses are not merely hypothetical, but unfortunately routine,” department spokesman Peter Carr said, citing a case in which early disclosure put at risk a cooperative witness in a case. He declined to offer details because the case was under seal.

Once again, it seems like the DOJ and others think that anything that makes their job harder is somehow wrong. But that's incorrect. The whole point of protecting freedom is that it's supposed to be hard for law enforcement to spy on people and arrest them. That's how it's supposed to work.

Filed Under: doj, law enforcement, privacy, protecting users, subpoenas, tech companies, warrants
Companies: apple, eff, facebook, google, microsoft, twitter, yahoo

Florida Convict Appealing 162 Year Sentence Over Warrantless GPS Evidence

from the tumbling-down dept

A couple of months back, Tim Cushing wrote about a Massachusetts court finding that warrants are indeed required in order for law enforcement to get cell phone GPS data for use in a criminal case. That victory for the Fourth Amendment rights of US citizens was bound to have wide-ranging repercussions within the legal and penal systems. We didn't have to wait long, as one Florida man is appealing his 162 year prison sentence because prosecutors relied in part on locations data obtained without a warrant in his trial.

Lawyers for a south Florida man serving almost 162 years in prison for his role in a string of armed robberies told a U.S. appeals court that prosecutors had no right to use cell phone location data during his trial and the double life sentence without parole was cruel and unusual punishment. The American Civil Liberties Union (ACLU) argued that authorities should have had to show probable cause and obtain a search warrant before seeing cellphone records for 22-year-old Quartavious Davis. The case comes as federal circuit and appeals courts around the country have been wrestling with cellphone privacy issues.

Now, it should be noted that the prosecution also had the testimony of several alleged accomplices of Davis', who all received shorter sentences for their cooperation, and this post isn't intended to proclaim his innocence. In fact, he may very well be guilty, which is what makes the government's cavalier attitude towards gathering evidence all the more egregious. If this guy is guilty and walks on a technicality, when better police work could have kept him behind bars, that's on the government.

That said, regardless of his guilt, the sentencing aspect of this case is insane.

The unusually long sentence stemmed from a controversial practice known as "stacking," in which each charge in an indictment is counted as a separate crime. The policy transforms a first-time offender into a "habitual criminal" subject to multiple sentences and mandatory sentencing guidelines.

The district court judge said if he had been able to make the decision himself, "he would have given him 40 years with parole," said Shapiro.

Nothing like a little prosecutorial trick to simultaneously make a name for one's self and ensure that justice takes a backseat to politicizing the life-sentence of a man prosecuted with warrantless GPS data.

Filed Under: 4th amendment, florida, gps, sentencing, warrants

Government Presents Its Arguments For Warrantless Cellphone Searches, Thinks Officer Discretion Will Prevent Abuse

from the terrible-arguments-made-terribly dept

The other Supreme Court case dealing with warrantless cell phone searches heard oral arguments this week, with some intermingling from a lawyer presenting the US government's side in a related case (US v. Wurie). We recently covered the government's arguments for warrantless searches in US v. Wurie, a case dealing with outdated technology -- a flip phone. This case (Riley v. California) is from 2013 and deals with a smartphone, one that received a much deeper search by police officers.

In both cases, no one sought a warrant. The government argued in the Wurie case that a warrant "served no purpose" but to allow the locked-up criminal to erase evidence from a phone in police possession. Lots of technological speculation was presented, suggesting that every small-time crook would wipe or encrypt their phone to prevent the recovery of evidence. The government presented a tech arms race where law enforcement is always losing as the impetus for throwing the Fourth Amendment out the precinct window.

Strangely, in both cases, the government has made the claim that the officers involved already had enough probable cause to secure a warrant, but they simply chose not to. Jeffrey Fisher, arguing for Riley, points out that this is no excuse.

This Court has said time and again that the mere fact the police could have gotten a warrant but didn't does not excuse a Fourth Amendment violation.

If this "we could have gotten a warrant" excuse seems familiar, it's because it's been used far too often to justify warrantless searches. Earlier this year, the Tallahassee Police Dept., in its defense of its privacy-violating Stingray deployment, told a judge that it could have secured a warrant (but didn't) with all the probable cause it had in its possession, a statement that prompted this outraged response:

When the government attorney tried to argue in court that the police had planned to obtain a warrant to enter the apartment, one of the judges interrupted.

"No, no, no, no, no," he said. "I think this record makes it very clear they were not going to get a search warrant because they had never gotten a search warrant for this technology."

His fellow judge then interjected loudly, "Two-hundred times they have not."

So, there's the government antipathy towards warrants on full display. But the warrant process does something very important: it forces the police to justify the search, narrow the scope and put it all in front of a (supposed) neutral party -- a magistrate judge. In actuality, it's usually a very speedy process, but during these arguments, the government acts like it's a horribly laborious imposition.

In Riley's case, the lack of warrant requirement allowed the police to browse Riley's phone until it found something incriminating.

He [detective] said, at JA­11, we looked at a whole lot of stuff on the phone and that's just what, in his words, "caught his eye."

As Fisher points out, the government's idea of protecting someone's rights involves searching first and allowing questions to be asked later -- a complete inversion of how the Fourth Amendment is supposed to work.

What the government says is let the officer look and then have a back­end hearing where you just suppress all the stuff that he wasn't supposed to look at once you apply particularity requirements.

This attitude (also on display in the Wurie response) presumes people will make it to that point, rather than taking a plea or simply not having the resources to fight a suppression battle in court. This places the onus on the wrong party and puts citizens in the terrible position of policing law enforcement at their own expense.

As the justices point out during their discussion with Fisher, there are still exceptions available to police even if a warrant requirement were put in place. It's a big loophole but one that should be considered necessarily rare (which it probably won't be in practice): exigent circumstances.

During this discussion, an interesting point emerged. The state itself reached the same conclusion as Riley's legal team: there's no useful analogue from past cases that offers comparative circumstances for today's smartphones.

[W]e have an exploratory search where not even the State has contended the amount of information looked at is equivalent to what somebody could have carried around in the old days.

The government's favorite apples-to-oranges comparison -- the diary -- is even worse than simply saying the phone is nothing more than an address book with some pictures between the pages. Not only is it a relatively worthless comparison, but even the few originating cases are outliers. For the government to consider a phone to be a diary, it has to ignore huge amounts of context before beating the argument to fit and painting it to match, as Fisher points out.

The reason I think that you don't find diary cases when you look for them is because people hardly ever carry a diary outside the home with them. It was kept in a private drawer in the bedroom or wherever it might be kept, and in the highly, highly unusual circumstance where somebody did, you might have a hard case.

This… is the opposite world. The modern reality of smartphones is that it is an indispensable item for everyday life of a modern professional and, indeed, most anyone. You can't leave the house without it and be ­--­ consider yourself to be responsible and safe. And so you take ­­ to take a world where the police might try to say, we can get the stray diary because of the importance of the categorical rule under Robinson and try to apply that into a world where everybody has everything with them at all times…

Edward Dupont, representing California, advances a familiar government argument -- if it doesn't violate in a singular instance, then expansive searches pertaining to the same sort of subject matter doesn't suddenly result in a Fourth Amendment violation. (This has been deployed in defense of the NSA's surveillance programs.)

The theory, even if I'm carrying only five photographs or if I'm carrying two letters as was the case in the Chiagles case, for instance, that Judge Cardozo decided in the '20s, they are likely to be very personal, very private photographs. So I'm not sure that the expansion of volume increases the invasion of privacy.

On one hand, multiplication by zero. On the other hand, smartphones aren't just ostentatious data generators -- they have practical uses as well. To quote a decision from the Massachusetts Supreme Court which ruled warrantless access to cellphone GPS data was unconstitutional:

"People buy [cellular telephones] to communicate with others, to use the Internet, and for a growing number of other reasons. But no one buys a [cellular telephone] to share detailed information about their whereabouts with the police"

Justice Kagan asks if any arrest (a seatbelt violation in this instance) should allow police to search cell phones. Dumont calls that a "marginal case" and not relevant to the discussion. Kagan disagrees:

Your argument and the Solicitor General's principal argument applies to any arrest. And it applies to everything on a cell phone. People carry their entire lives on cell phones. That's not a marginal case. That's the world we live in, isn't it?

Dumont then argues that this particular case doesn't deal with an "entire life" on a cellphone, so this potentiality shouldn't be considered. Fair enough, in terms of particulars, but this is the Supreme Court -- the highest court in the land. What it decides becomes standard operating procedure for law enforcement from this point on. Dumont seems to think he can conveniently bury his head in this case and ignore the numerous implications it raises. Justice Ginsburg makes this point.

The Court is to make a rule not for this particular case, but for this category of cases. And I think what Justice Kagan pointed out is very nervous concern. [...] It's your rule, then, that the cell phone is fair game no matter what the crime, no matter how relatively unimportant the crime. Is it all misdemeanors, all misdemeanors and that opens the world to the police.

Dumont then claims that this case is "different" because it involved a "violent" suspect, rather than a lesser form of criminal. Justice Kennedy smacks that argument into the stands.

MR. DUMONT: I think you need to look at the generality of cases. And in the generality of cases, first of all, you will not be dealing with minor crimes. You'll be dealing with serious crimes. And second, you'll be dealing with police who are --­­ undo their job by booking ­­--

JUSTICE KENNEDY: Are you saying we're just resting on the discretion of the officer? Because if that's so, then that leads to the next question. Well, if that's so, then we'll get a warrant.

After that, Dumont tries to make the point that sometimes there's not going to be an opportunity to get a warrant, which apparently he feels is problematic enough that any warrant requirement should be eliminated. Kennedy reminds Dumont that he's wandered back into "exigent circumstances" territory, an option that will still be available even if the Court decides warrants are necessary.

Justice Breyer tries to nail down where the government actually stands on the warrant issue.

So there are three possibilities: Possibility one, smartphone, no, get a warrant, unless exigent circumstances. Possibility two, yes, it's just like a piece of paper that you find in his pocket. Or possibility three, sometimes yes, sometimes no. All right, which of those three is yours?

Dumont isn't willing to go quite as far as the government did in its filing in the Wurie case (warrants just prevent cops from catching bad guys) -- at least not while speaking directly to the justices.

[M]y in­between rule with the explanation is that for information that is of the same sort that police have always been able to seize from the person, that includes diaries, letters, all other kinds of evidence, purely evidentiary, photographs, address books, for evidence of that same sort, the same rule should apply.

That's not an answer, and the Justice Breyer knows it. The government is again arguing for LEO discretion, which isn't a place any court can (or should) draw the line.

Your rule is sometimes. So I say: Sometimes; what's that? And you say if it is the kind of thing that the police could have searched for if it wasn't on the computer, then they can search for it on the computer. Now, since they can search for everything in your pockets before when it isn't the computer, then why isn't yours everything? [...]

So I guess what you're saying is I thought it was category two, sometimes, but really it's category three, always.*

It certainly appears the government has exactly that in mind -- no warrant requirement. Ever. The lawyer claims "sometimes," but refuses to delineate further than "we'll know it when we see it." Here's Dumont again, attempting to craft the haziest bright line ever by arguing that simply being arrested -- never mind actually charged -- removes nearly every expectation of privacy.

[T]he fact of the arrest necessarily and legitimately largely abates the privacy interest of the individual and his person and anything he or she has chosen to carry on the person.

Now, modern technology makes it possible for people to choose to carry a great deal of information. But that doesn't change the fact that the reasonable expectation, if a person is subject to custodial arrest, is that the police will search the person and look at things that they find…

Justice Kagan in response:

In other words, one has to keep one's cell phone at home to have an expectation of privacy in it?

Dumont digs in, and the argument gets even worse. Now, he claims citizens need to expect that their cell phones are, for all intents and purposes, open books for law enforcement to avail itself of. If they don't like that "fact," they can just not use a cell phone.

No, we're not saying that at all. But what we are saying is that people do make choices, and those choices have consequences. And the consequence of carrying things on your person has always been that if you are arrested, the police will be able to examine that to see if it is evidence of crime.

This makes no more sense than the government's argument that a no-fly list doesn't violate anyone's rights because flying is a "convenience." The reality of the situation is that a cell phone -- much like air travel in a country of this size -- isn't really a choice. It's a necessity. But the government acts as though people are complaining about the downside of pure luxuries.

Michael Dreeben, also arguing for the government, thinks the reduction of privacy as the result of an arrest makes this all acceptable. But Justice Ginsburg wonders why, if the person is being detained, is it so impossible to just go and get a warrant?

But, Mr. Dreeben, if the --­­ the understanding was, when there's time, get a warrant. So here, you can seize the phone and you can secure the phone, and you could go to a magistrate and within an hour get permission to search. But what is the reason for cutting out the magistrate here?

In response, Dreeben presents the same hypothetical -- that a criminal will wipe the phone during the hour or so it takes to get a warrant. Dreeben presents only anecdotal evidence from the FBI and other stuff he "heard" from other state police in support of this theory that a majority of criminals have implemented wiping technology.

Justice Breyer:

[Y[ou're saying now we should allow searches of all cell phones because there might be a technology that hasn't yet in fact been used in any of the States that have this rule.

After a lot of arguing over whether the "no warrant" rule would apply to arrests for non-serious criminal activity (the government says it won't but obviously can't really make that promise), Dreeben says this lack of Fourth Amendment protection is the best thing for "society."

At that moment society's interests are at their apogee in locating evidence relating to the crime of arrest and apprehending related suspects, and the suspect has a highly reduced privacy interest.

In the interest of simplification and the establishment of a bright line, the "always obtain a warrant" would appear to be the correct decision, one that still provides Fourth Amendment protections. The government's fear of wiped phones and encryption seems to be largely based on speculation and anecdotes, rather than any documented evidence. There are ways to prevent remote wiping, but the government considers those to be too burdensome to entertain seriously.

The warrant process will always be accompanied by the exigent circumstances loophole, which would allow police to weigh officer and public safety as factors for speedier access. But in most cases -- and most certainly in this one -- there is plenty of time to obtain a warrant. In this particular case, the disputed search didn't occur until two hours after the arrest.

But the government doesn't want a bright line. What it wants is instant access and it expects the public to be perfectly fine with the decision resting in the hands of "officer discretion." But it's extremely doubtful the public has much faith in officer discretion at this point, and the government's own actions have indicated that law enforcement agencies tend to perform a lot of fishing expeditions simply because standing decisions allow them to. Reduced privacy expectations in all things has been the government motto -- it makes NSA surveillance "legal" and allows investigators to dig around in people's electronics.

The justices don't seem to be very moved by the government's assertions. There was a lot of pushing back, which is a good sign. The downside is that these arguments really made no headway towards a more thoughtful approach to modern technology, even with the justices throwing around terms like "Facebook" and "Fitbit."

Filed Under: 4th amendment, mobile phones, riley, searches, supreme court, warrants, wurie

US Judge Says Prosecutors Can Use A Warrant To Go Fishing For Information Held Overseas

from the jurisdiction:-the-whole-world dept

We've had some discussion concerning the NSA and its defenders arguing that the 4th Amendment doesn't apply outside of the US, but it seems they also believe that the US jurisdiction applies basically anywhere when they want it to. While we recently wrote about magistrate judges pushing back on overly broad requests for information, that clearly is not absolute. Magistrate judge James Francis recently ruled that Microsoft needs to turn over data held on servers in Dublin, even though a US warrant isn't supposed to apply outside the US. Microsoft, quite reasonably, sees this as a problem:

"A U.S. prosecutor cannot obtain a U.S. warrant to search someone's home located in another country, just as another country's prosecutor cannot obtain a court order in her home country to conduct a search in the United States," the company said. "We think the same rules should apply in the online world, but the government disagrees."

As does the judge. The judge's own explanation is basically that he's pretending the warrant is not a warrant, but a subpoena.

Francis agreed that this is true for "traditional" search warrants but not warrants seeking digital content, which are governed by a federal law called the Stored Communications Act.

A search warrant for email information, he said, is a "hybrid" order: obtained like a search warrant but executed like a subpoena for documents. Longstanding U.S. law holds that the recipient of a subpoena must provide the information sought, no matter where it is held, he said.

If the Stored Communications Act sounds familiar, that's because it's a part of ECPA, the horribly outdated law that we've been discussing for years concerning its need for reform. If this ruling stands (and Microsoft is already challenging it), it'll be just one more thing that ECPA reform needs to tackle.

Filed Under: 4th amendment, international, james francis, privacy, prosecutors, warrants
Companies: microsoft

Magistrate Judges Emboldened By Snowden, Pushing Back On Overly Broad DOJ Requests

from the good-for-them dept

A couple weeks ago, we wrote about how the judiciary was finally pushing back on overly broad and vague warrant requests from the DOJ, with magistrate judge John Facciola leading the way. That was based on a Wall Street Journal article highlighting how magistrate judges like Facciola and David Waxse have been pushing back much more regularly on requests. The Washington Post has now written a very similar article (though, like most stuck up mainstream publications, it never mentions the WSJ article that beat it to the punch) that is worth reading as well. While it repeats much of the same story from the WSJ one, it also adds some interesting details. The basic story is basically the same. Facciola and others have been pushing back steadily on requests:

Among the most aggressive opinions have come from D.C. Magistrate Judge John M. Facciola, a bow-tied court veteran who in recent months has blocked wide-ranging access to the Facebook page of Navy Yard shooter Aaron Alexis and the iPhone of the Georgetown University student accused of making ricin in his dorm room. In another case, he deemed a law enforcement request for the entire contents of an e-mail account “repugnant” to the U.S. Constitution.

For these and other cases, Facciola has demanded more focused searches and insisted that authorities delete collected data that prove unrelated to a current investigation rather than keep them on file for unspecified future use. He also has taken the unusual step, for a magistrate judge, of issuing a series of formal, written opinions that detail his concerns, even about previously secret government investigations.

The article also notes that it's very likely that the Ed Snowden revelations have played a big role in the sudden uptick in magistrate judges pushing back:

The seeds of what legal observers have dubbed “the Magistrates’ Revolt” date back several years, but it has gained power amid mounting public anger about government surveillance capabilities revealed by former National Security Agency contractor Edward Snowden. Judges have been especially sensitive to backlash over the Foreign Intelligence Surveillance Court, which made secret rulings key to the growth of the surveillance programs.

A lawyer quoted in the article notes that the judges are now realizing that if they approve a bogus warrant, which later becomes public, it may now become an embarrassment:

“There’s a newfound liberation to scrutinize more carefully,” said Albert Gidari Jr., a partner at Perkins Coie who represents technology and telecommunications companies. “They also don’t want to be the ones who approve an order that later becomes public and embarrassing. . . . Nobody likes to be characterized as a rubber stamp.”

Of course, the inference there is depressing, if unsurprising. Back when they could work in relative secrecy, judges were a lot more willing to just go along with law enforcement. We've been saying since the beginning that transparency, sunlight and accountability are important components in maintaining the Constitution, and this newfound backbone from the judiciary certainly seems to suggest that's true. It also shows just how far-reaching the impact of Snowden's actions have been. It's not just about the NSA, but it's priming the key folks who make the federal judiciary function, the magistrate judges, sit up and pay more attention.

The other tidbit of information, is that the magistrate judges apparently all have a mailing list where they discuss some of this stuff, suggesting that this growing "revolt" (if you can call actually following the Constitution a "revolt") may continue to spread:

Magistrate judges, who do much of the routine work of the criminal justice system, influence each other through conversations at judicial conferences and through the federal e-mail system, which allows any magistrate judge to query all others on a vexing legal question with a single click of the mouse.

Perhaps even more interesting is that one of the magistrate judges handling these issues has even designed a joke t-shirt that he sends to any judges who have to rule on warrants concerning mobile phone information:

Tackling such issues, even in the face of possible reversal by higher courts, has become something of a badge of honor among some magistrates. Judge James Orenstein of Brooklyn, a former federal prosecutor who also wrote an early, influential ruling on cellphone location data, once joked with Smith that they would soon have enough like-minded magistrates to form a bowling team, Smith recalled.

That prompted Orenstein to design shirts featuring the image of a bowling ball rolling toward a cellphone and nine cell towers arranged in a triangle like a set of bowling pins. Above the image it read, “CSI: Cell Site Information.” Below it read, “Bowling for Dialers.”

When other magistrates write opinions on the issue — regardless of which side they take in the debate — they are offered one of the shirts.

While a bit more jokey than you'd normally expect from some judges, things like this certainly help remind the judges that these kinds of requests are important to pay attention to, and aren't "just another" request to rubber stamp. That's a good thing.

While the article notes that the government is starting to more aggressively appeal these magistrates (and some federal judges have been overturning them) it's still good to see the magistrates stepping up and tackling this issue.

Filed Under: 4th amendment, david waxse, doj, ed snowden, john facciola, magistrate judges, warrants