Fifth Circuit Says No Warrants Needed To Obtain Near-Real Time Cell Site Location Info

from the prospective-records-just-records-apparently dept

The Fifth Circuit Appeals Court has issued a ruling on cell site location data which basically gives the government permission to engage in real-time tracking without a warrant. The acquisition of historical cell site location data is still the source of much judicial dispute. But at the federal appellate level, courts that have handled these cases have decided no warrant is needed. Location records are just another thing law enforcement can have warrantless access to, thanks to the Third Party Doctrine.

Prospective location records, like those obtained in this case, have received less scrutiny. While ostensibly third party records, these allow for "real-time" tracking of individuals using records flowing directly to law enforcement almost as quickly as they're obtained by the cell service provider. A defendant tracked using this poor man's Stingray moved to have the evidence suppressed, arguing the near-real time warrantless "search" violated his Fourth Amendment rights. The court disagreed, finding the momentary landing at the service provider was enough to make them third party records, even if law enforcement was figuratively (or possibly literally) hovering over the cell provider's shoulder as the location records rolled in. From the ruling [PDF]:

There is little distinction between historical and prospective cell site data. As in Historical Cell Site Data, here the government sought “the disclosure of the locations of cell site towers being accessed by [Wallace’s] cell phone” as recorded in future records “captured, stored, recorded and maintained by the phone companies in the ordinary course of business.” “While this information is ‘prospective’ in the sense that the records had not yet been created at the time the order was authorized, it is no different in substance from the historical cell site information . . . at the time it is transmitted to the government.” Booker, 2013 WL 2903562, at *7. The information the government requested was, “in fact, a stored, historical record because it [was] received by the cell phone service provider and stored, if only momentarily, before being forwarded to law enforcement officials.”

So, as it stands here (and in other courts), the government is free to obtain phone records from the past and the future -- and, with a "momentary" landing, location records as they're produced. As the court states here, third party records are third party records, whether or not they've been created yet. Even if the officers were wrong about this, the good faith exception would have allowed them to keep the fruits of their search, according to the court.

It's not a great decision. It allows law enforcement to ask for nearly any cell site location records without stating more than a few "articulable facts." An order could be fashioned to serve as open-ended surveillance, allowing officers to track someone for an indefinite amount of time without ever showing a law enforcement need to do so. It also could serve as cover for Stingray use by providing a parallel set of "real-time" location records.

What the decision doesn't explicitly do is give law enforcement permission to deploy Stingrays without warrants. Stingrays turn the government into the "third party," which isn't an acceptable use of the Third Party Doctrine. But that's another area federal courts really haven't delved into yet -- not because Stingray use is so limited, but because the FBI-enforced secrecy surrounding cell tower spoofers has prevented defendants from mounting many successful challenges. Charges tend to be dismissed if defendants get too close to the truth.

It's a published opinion so it has a little precedential weight. But the opinion spends more time quoting other opinions than breaking much new ground here. Unfortunately, the ground broken here is more victim-blaming, reminding defendants it's their own fault they use cellphones, as if most cellphones users were keenly aware their phones act as tracking devices… and as if it weren't a massive law enforcement boon that all of this info can be had without a warrant, thanks to a doctrine in severe need of a massive update.

Filed Under: 4th amendment, cell site location info, csli, searches, third party doctrine, warrants

After Appeals Court Flip-Flop, Aaron Graham Asks Supreme Court To Examine Warrantless Access To Cell Location Info

from the one-more-time dept

Aaron Graham -- the defendant at the center of a Fourth Amendment dispute over the warrantless acquisition of cell site location info -- is hoping to get one more court to take a look at his case.

Last summer, the 4th Circuit Court of Appeals became the first appeals court to institute a warrant requirement for historical CSLI. As was noted then, the court found that the records generated by cell phones (and held by phone companies) had an expectation of privacy -- at least when obtained for a significant period of time. In Graham's case, the government obtained 221 days of historical cell site location data -- the sort of extended period the Appeals Court found troubling… originally.

The government appealed and attempted to differentiate its long-term, post-facto tracking of Graham's movements with eight months of CSLI from the Supreme Court's Jones decision -- which (sort of) found that deploying a surreptitious GPS tracker required the use of a warrant. It claimed this form of location tracking was completely different than the other form of location tracking, mainly because in Graham's case the tracking was done by the phone company. The government simply benefitted from the warrantless collection of records the phone company was already compiling.

The court bought the government's arguments the second time around. The short-lived warrant requirement was removed and the 1979 definition of the Third Party Doctrine (Smith v. Maryland) was reinstated. The dissent correctly pointed out that no cell phone user voluntarily turns over location data to service providers. It's just something that has to happen for phones to make calls or access data. It also pointed out that, unlike other third-party records, customers aren't allowed to access their own cell site location data. Only the phone company and the government can do that, even though it's the customer generating the records and paying for their collection and storage.

Graham is now petitioning [PDF] the Supreme Court to review the case. (h/t Gitmo Watch) If it does, things could get interesting. Unfortunately, there's no telling which version of "interesting" we'll get.

As it stands now, there's no cohesive stance on CSLI in the nation's courts. If there are precedential findings, most side with the government's Third Party Doctrine theory. A few lower courts have recognized an expectation of privacy in these auto-generated records, but at the Appeals Court level, nothing else has come down in favor of this finding. There are some open pending appeals, but no rulings have been handed down yet.

The cert petition notes that courts should not be so quick to extend a benefit of a doubt to law enforcement agencies who do everything they can to avoid filling out a search warrant application.

Leon explains that police officers who obtain a warrant that appears to satisfy the probable cause requirement can “literally” do “nothing more . . . in seeking to comply with the law.” Id. at 921 (internal quotation omitted). Suppressing evidence after a police officer conducts a search with a warrant in hand will not serve the exclusionary rule’s deterrent effect because suppression would not “alter the behavior of individual law enforcement officers or the policies of their departments.” Id. at 918.

The Fourth Circuit’s contrary conclusion misapplies Leon to the point of creating a direct conflict with this Court’s precedent. Here, in contrast, law enforcement easily could, but chose not to, follow the constitutionally secure path. They could have followed 18 U.S.C. § 2703(c)’s explicit warrant requirement, which clearly satisfies the Fourth Amendment, instead of taking their chances with the non-warrant procedure of § 2703(d). Unlike Leon, the prosecutor who sought and used the § 2703(d) order knew that the order was neither a warrant nor the equivalent of a warrant, and knew that the constitutionality of his choice was already in doubt.

Graham argues the evidence obtained should be suppressed, rather than put back into service on the back of the good faith exception and a multitude of conflicting court decisions. A deterrent only works if you actually apply it.

Indeed, suppressing the evidence here would alter the behavior of both individual officers and policies of departments and thus would serve the deterrent purposes of the exclusionary rule. Prosecutors and police departments would be put on notice that they should not always be looking for loopholes to the warrant requirement. They would know that in the future, documents that do not satisfy the Fourth Amendment’s warrant requirement more likely than not will not justify the search of a citizen’s person, papers, and effects.

Whether or not the Supreme Court will take also remains to be seen. The court has been rather schizophrenic on its Fourth Amendment decisions in recent years and it may not be in any hurry to handle something with this many future implications while it's still short a justice.

Filed Under: 4th amendment, aaron graham, csli, location info, scotus, supreme court

Federal Judge Says Real-Time Cell Location Info -- Whether Obtained With A Stingray Or Not -- Requires The Use Of A Warrant

from the no-more-pen-register-orders dept

An interesting decision by a federal judge in Florida suggests this district, at least, may not be amenable to the warrantless use of Stingray devices… or any other method that harvests cell site location data in real time.

Although the defendants lost their motions to suppress due to a lack of standing, the judge had this to say about the acquisition of cell site location info in this case. (via FourthAmendment.com)

Here, I agree with the Defendants that law enforcement's seizure of precise realtime location information by surreptitiously monitoring signals from the cell phones in this manner is a search subject to the proscriptions of the Fourth Amendment. Such is the express conclusion of the Florida Supreme Court and the conclusion suggested by the Supreme Court. See Tracey v. Florida, 152 So.3d 504 (Fla. 2014); United States v. Jones, 132 S.Ct. 945 (2012). As such, law enforcement should have obtained a search warrant issued upon probable cause. The Government concedes that the practice in this Court requires a warrant based upon probable cause for such searches and that the these pen/trap applications did not establish probable cause.

Originally, the defense claimed police used a Stingray to track five burner phones used by the defendants. This seemed to be the most logical conclusion, considering how closely and immediately the location data was acquired. But the government responded that no cell site simulators were used to track the devices. Instead, another tool that has long been available to law enforcement was deployed -- a tool created explicitly for law enforcement use by the cell provider.

On July 21, 2016, the Court heard argument of counsel and took testimony from Detective Joseph Petta, the co-affiant on each of the applications at issue. In short, Detective Petta testified that law enforcement obtained pen/trap authorizations for the cell phone numbers at issue in order to obtain precise realtime location information that was used to track the whereabouts of these phones, to identify those associated with Defendants, and to identify locations of interests. He denies use of a Stingray or similar device, but acknowledges that he used a website offered to law enforcement by Sprint (the "L-site") to obtain such information. Such realtime information was available every fifteen minutes twenty-four hours a day. He further acknowledges that law enforcement used the realtime information to track the cellular phones, which they believed were used by this group. By his account, such applications were the usual way to obtain such realtime location information at the time these applications were submitted.

[...]

According to Detective Petta, the website allows law enforcement to log on and obtain realtime or contemporaneous and highly precise longitudinal and latitudinal information linked to GoogleMaps. A spreadsheet of all such location data is made available to law enforcement. Detective Petta testified that the pen/trap orders were not used for any other purpose than to obtain the realtime location of the cell phones.

The information returned from L-site queries is likely not as timely or precise as a roving Stingray but can achieve the same objectives. (An example of L-site data can be seen here.) Sprint has made this tool available for law enforcement to use since at least 2009, tracking roughly with the rise in Stingray use by police departments. The difference here is any law enforcement agency can obtain this data, which opens the market to those who don't have these devices yet or a warrant requirement they'd rather work around. Obviously, this also aids those deploying parallel construction to keep Stingray use hidden.

Either way, the court doesn't agree with the government's assertion that a pen register order is sufficient for obtaining real-time cell site location info. The order cites the Supreme Court's US v. Jones decision in support of its determination that real-time location tracking is a search and requires the use of a warrant -- something the original decision failed to state quite as explicitly. (It only found that placing a GPS device on a vehicle is a search under the Fourth Amendment. The issue of real-time location tracking remained mostly unaddressed.)

But while this order may alter law enforcement's tactics (and even the government admits it should have acquired a warrant in light of other Florida district decisions), it does nothing for the two defendants. An expectation of privacy in real-time location data doesn't help two defendants with a handful of burner phones they're reluctant to claim as their own. The absence of any link between the tracked phones and the defendants means they have no standing to challenge the search.

Defendants here have asserted no claim to or interest in the cell phones at issue. The cell phones were not registered in Defendants' names, and Defendants presented no evidence regarding their possession, use, or control of the phones. Instead, Defendants rely solely upon loose allegations in the pen/trap applications submitted by the Government, which suggested a link between the cell phones and Defendants in conclusory, unsupported fashion. In the circumstances and in the absence of contrary case law, I am obliged to conclude that they fail to establish standing to contest the searches at issue and the motions to suppress should be denied.

A lack of standing tends to be fatal to motions to suppress. But the disavowal of ownership does shift the burden of proof back on the government, which makes it a little harder to prove the burner phones actually belonged to the defendants found carrying them. The court notes the "loose allegations" contained in the pen register applications are "conclusory" and "unsupported," which seems to indicate the government has a few more hurdles to overcome before it can tie the defendants to the phones they're not willing to claim.

Filed Under: 4th amendment, csli, imsi catcher, location info, stingray, warrants

4th Circuit Appeals Court Rolls Back Its Warrant Requirement For Cell Site Location Info

from the the-'summer-of-the-Fourth-Amendment'-is-so-last-year dept

The Fourth Circuit Court of Appeals was one of the few appeals courts to rule on the constitutionality of obtaining cell site location info without a warrant. And it was -- was -- the only appeals court to find warrantless access violated the Fourth Amendment. The decision was limited to the collection of historical cell site data for extended periods of time (the court appeared to believe anything beyond two weeks was questionable), mainly because there was a good chance the records would contain considerable detail about a person's movements in private places.

The government immediately requested an en banc hearing by the Appeals Court. The hearing was granted and the court has patched up its split with the other circuits by finding in favor of the government and the Third Party Doctrine. [PDF link]

We now hold that the Government’s acquisition of historical CSLI from Defendants’ cell phone provider did not violate the Fourth Amendment.

Supreme Court precedent mandates this conclusion. For the Court has long held that an individual enjoys no Fourth Amendment protection “in information he voluntarily turns over to [a] third part[y].” Smith v. Maryland, 442 U.S. 735, 743-44 (1979). This rule -- the third-party doctrine -- applies even when “the information is revealed” to a third party, as it assertedly was here, “on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.” United States v. Miller, 425 U.S. 435, 443 (1976).

All of our sister circuits to have considered the question have held, as we do today, that the government does not violate the Fourth Amendment when it obtains historical CSLI from a service provider without a warrant. In addition to disregarding precedent, Defendants’ contrary arguments misunderstand the nature of CSLI, improperly attempt to redefine the third-party doctrine, and blur the critical distinction between content and non-content information.

The Supreme Court may in the future limit, or even eliminate, the third-party doctrine. Congress may act to require a warrant for CSLI. But without a change in controlling law, we cannot conclude that the Government violated the Fourth Amendment in this case.

The nod to 1979's Smith v. Maryland is back in place, setting this decision firmly in Third Party Doctrine territory. If it's "voluntarily conveyed" to a third party, the government doesn't need a warrant to access it. The key, though, is the "voluntary" part. While the majority finds the collection of cell site location data by service providers to be somehow a "voluntary" conveyance by customers, the three dissenting judges aren't as impressed by this argument.

The dissenting opinion (starting at p. 47) goes through the majority decision's citations and sees a whole lot more voluntary effort being made by citizens than what happens during the automatic acquisition of cell site info by phone companies.

The Supreme Court, then, has intentionally employed the “voluntary conveyance” concept in every relevant case to limit the reach of an otherwise sweeping per se rule that denies Fourth Amendment protection. It seems therefore crucial here to ask: what, precisely, did the Court mean when it chose those words, in the context of those cases?

Here is what those various defendants actually did to “voluntarily convey” information. One used his finger to dial, one by one, the numerical digits of a telephone number. Smith, 442 U.S. at 741 (highlighting that pen registers disclose “only the telephone numbers that have been dialed” (quoting United States v. N.Y. Tel. Co., 434 U.S. 159, 167 (1977))). Another submitted multiple checks and deposit slips—each presumably bearing a date, a dollar amount, a recipient name, and a personal signature. Miller, 425 U.S. at 442. The others actually spoke. White, 401 U.S. at 746–47 (conversations with a bugged government informant related to narcotics transactions); Hoffa, 385 U.S. at 296 (statements to an associate “disclosing endeavors to bribe [jury] members”); Lewis, 385 U.S. at 210 (conversations with an undercover law enforcement agent in the course of executing a narcotics sale).

In all of these cases—the only cases that can bind us here— “voluntary conveyance” meant at least two things. First, it meant that the defendant knew he was communicating particular information. We can easily assume Miller knew how much money he was depositing, that Smith knew the numbers he was dialing, and that Hoffa, Lewis, and White knew about the misconduct they verbally described to another.

Second, “voluntary conveyance” meant that the defendant had acted in some way to submit the particular information he knew. Crucially, there was an action—depositing, dialing, speaking— corresponding to each piece of submitted information. And where many data pieces were compiled into records—financial records in Miller, phone records in Smith—there was presumptively a discrete action behind each piece of data. The Court never suggested that the simple act of signing up for a bank account, or a phone line, was enough to willingly turn over thousands of pages of personal data.

The dissent goes on to point out that CSLI -- unlike other "voluntarily conveyed" third-party records -- isn't even made available to the customers that generate it. Customers have access to call records, bank statements, and other information collected under the Third Party Doctrine, but there's no easily-accessible way for citizens to view the location records they're conveniently generating for the government. This lack of access to information strongly suggests the collection of cell site location data by phone companies has nothing to do with voluntary conveyance.

The majority believes that if a "fix" is required, it should be left to legislators.

The legislative branch is far better positioned to respond to changes in technology than are the courts.

This is said with a straight face before using the Electronic Communications Privacy Act as an example of legislators' prowess: a law gives the government access to the contents of any electronic communications older than 180 days -- and which has yet to be updated in any serious form by legislators over the past 30 years, even as the tech landscape surrounding it has experienced monumental changes.

The majority maintains Congress "has not been asleep at the switch" since the ECPA's institution. And it's somewhat correct. Attempts have been made to rewrite the law in reaction to the explosion of electronic communications since the mid-80s, but forward motion has been stalled by government agencies unwilling to cede ground to shifting expectations of privacy. So, yes, Congress can fix it, but it needs to run a gauntlet of agencies it's in no hurry to anger and administrations that overwhelmingly oppose any minimal contractions of government reach or power. And if Congress hasn't made any significant progress towards trimming back the Third Party Doctrine's overgrowth since 1979's Smith v. Maryland decision, it's tough to believe that this is the decade where it will finally make its move.

Filed Under: 3rd party doctrine, 4th amendment, cell site location info, csli, location, privacy, warrants

Sixth Circuit Says Cell Site Location Data Just A Business Record; No Warrants Required

from the what-Smith-v.-Maryland-has-wrought dept

To date, four appeals courts have entered opinions on whether cell site location info is covered by the Fourth Amendment. So far, only the Fourth Circuit Court of Appeals has found this to be worthy of a warrant. All others find CSLI to be covered under the Third Party Doctrine. These cases all deal with historical cell site location info, usually obtained in bulk with subpoenas. Near real-time tracking using tower pings is another issue entirely -- one that's rarer because a) obtaining rolling CSLI from a provider is a pain and b) everyone's using Stingrays now.

The Sixth Circuit Court of Appeals is the fourth appeals court to find CSLI isn't covered by the Fourth Amendment. By this point, the arguments against greater privacy protections are all too familiar.

It's Just Metadata:

Content, per this distinction, is protected under the Fourth Amendment, but routing information is not.

It's not as precise as other tracking methods, so not really a problem:

The defendants argue that the government’s collection of those records constituted a warrantless search in violation of the Fourth Amendment. In making that argument, however, the defendants elide both the distinction described above and the difference between GPS tracking and the far less precise locational information that the government obtained here.

The amount of data gathered by the FBI is impressive. Relying on orders issued by three different magistrate judges, the FBI obtained 6-7 months of location info for 16 different cellphones. The coarse location info (accurate to within a half-mile in most cases) helped place two of the suspects near the scene of a couple of robberies. The suspects' attempt to suppress the evidence gathered by these orders made it all the way up the chain to the Appeals Court -- only to find the court affirm the lower court's denial of their motion.

The court quotes from 1979's Smith v. Maryland decision -- the cornerstone of a majority of pro-Third Party Doctrine arguments -- but fails to see any difference between obtaining call routing info tied to a non-mobile landline and information wholly unrelated to any communications generated by mobile phones as they connect to towers..

The court also quotes law enforcement's favorite argument: that people should know things they "share" involuntarily with cell providers are also things they involuntarily share with the government.

[A]ny cellphone user who has seen her phone’s signal strength fluctuate must know that, when she places or receives a call, her phone “exposes” its location to the nearest cell tower and thus to the company that operates the tower.

As in other cases dismissed using this same rationale, this representation of what people should or shouldn't know isn't just inaccurate (and highly dismissive of people who don't realize this give-and-take is part of cellphone operation) but it's also disingenuous. People likely know they generate some sort of location information. What they don't assume is that law enforcement can access records of their movements without a warrant.

The opinion also name-drops the Stored Communications Act -- part of the abysmal Electronics Communication Privacy Act -- as part of the reason the court won't be extending an expectation of privacy to location data.

Some other points bear mention. One is that Congress has specifically legislated on the question before us today, and in doing so has struck the balance reflected in the Stored Communications Act. The Act stakes out a middle ground between full Fourth Amendment protection and no protection at all, requiring that the government show “reasonable grounds” but not “probable cause” to obtain the cell-site data at issue here. See 18 U.S.C. § 2703(d). The defendants and the ACLU effectively ask us to declare that balance unconstitutional. There is considerable irony in that request. The Katz standard asks whether the defendants’ asserted expectation of privacy “is ‘one that society is prepared to recognize as reasonable[.]’” Smith, 442 U.S. at 740 (quoting Katz, 389 U.S. at 361). Here, one might say that society itself—in the form of its elected representatives in Congress—has already struck a balance that it thinks reasonable.

Hardly. The ECPA is a farce -- one that the government has used for years to obtain communications in bulk without a warrant.

Now, as to the lowered bar for obtaining CSLI -- a proxy version of location tracking -- historical data, especially one as "coarse" as CSLI is likely not going to be found to be worthy of Fourth Amendment protection… at least not by the courts. (Even in the Fourth Circuit decision, the concern was about the quantity of records obtained, rather than that they were obtained without a warrant.) As the opinion somewhat notes in its nod to Congress, this is an issue that needs to be addressed by legislation that more accurately reflects the privacy expectations of the public. The Stored Communications Act does not.

But courts do need to be wary of relying on Smith v. Maryland and constantly deferring to the Third Party Doctrine. Even in its coarse, historical form, CSLI reveals far more about a person's movements than law enforcement could obtain through any other warrantless method than following suspects in person. Law enforcement should not be prevented from availing themselves of technological advances, but the benefits need to be balanced against the public's expectations of privacy in records generated and collected as a result of phone usage.

Certainly, no one objects to pen registers for call routing data, but people honestly do not consider themselves to be nothing more than massive databanks the government can dip into with the most minimal of court oversight. Given the fact that many law enforcement agencies are deploying cell site simulators under the cover of pen register orders, the new normal should be an expectation of privacy in involuntarily-generated location data. Law enforcement likely finds coarse location data to be accurate enough for indictments and prosecutions and the continued denial of Fourth Amendment protection only encourages them to obtain CSLI with a court order rather than clear the higher evidentiary hurdles presented by the use of GPS devices.

Unfortunately, without Congressional action, most courts can only rely on legal precedent -- and the bulk of it considers parties generated by members of the public but collected and stored by companies to be unprotected by the Fourth Amendment. The only thing that's going to take Smith v. Maryland off the judicial table is new legislation or a Supreme Court decision declaring location data to have an expectation of privacy. The former seems almost as likely as the latter, but neither can truly be considered inevitable.

Filed Under: business records, cell site location, csli, sixth circuit, third party doctrine, warrants

Another Federal Judge Says No Expectation Of Privacy In Cell Site Location Info Because Everyone Knows Phones Generate This Data

from the because-TV-shows-about-cops dept

In the Seventh Circuit -- where there's currently no Appeals Court precedent on cell site location info (CSLI) -- federal judge Pamela Pepper has decided only about half of what other courts have said about this info's expectation of privacy applies. That would be the half that finds the Third Party Doctrine covers cell phones' constant connections to cell towers. (via FourthAmendment.com)

Three circuits (4th, 5th and 11th) have ruled on whether obtaining CSLI from providers constitutes a search or seizure under the Fourth Amendment. Only the Fourth found that this information deserved greater privacy protections, mainly because of the ubiquitousness of cell phones. The other two held that CSLI is just another business record, even if it is the sort of business record that generates a detailed history of someone's movements and can be used to track someone in near real-time.

The Supreme Court also had something to say about the long-term tracking of people's movements in its decision about GPS tracking devices. While not exactly the same thing, it was close, and the court here examines this decision as well. The government suggested long-term location tracking might have enough Fourth Amendment implications to justify a warrant requirement, but stopped short of making that call.

With these non-precedents in hand, Judge Pepper finds there's no expectation of privacy in cell location info because -- like the government has argued in other cases -- everyone should know their phones are acting as ad hoc government tracking devices.

This court disagrees that today, when many Americans own some sort of cell phone and carry it frequently, an individual’s expectation that the government could not track his whereabouts over time is reasonable. The media is rife with information—and sometimes warnings—about the fact that one’s location can be tracked from one’s cell phone.

[...]

Popular culture promotes the notion that the government, too, can determine extensive information about an individual from, among other things, one’s phone. In 2013, the news was filled with former National Security Agency contractor Edward Snowden’s revelations regarding the extent to which the NSA allegedly was collecting phone metadata without warrants or court orders; controversy continues regarding whether such a practice was justified, necessary or lawful.

As long ago as 2004, the popular HBO series “The Wire” devoted an episode to the use of the disposable prepaid cell phones used by the drug-dealing characters in the show.

Because of the pervasiveness of this info, Judge Pepper argues that everyone show know that cell phones generate location data and that the government can access this information without a warrant. The first assertion is likely true. People are mostly aware that their phones connect with cell towers and that they're constantly being asked by websites for permission to use their location info, etc. But it's not likely true that most Americans are aware these records can be obtained without a warrant.

The two media references the judge uses to back her claim that cell phone users must be aware the government can obtain location data have nothing to do with location data. Both only deal with the government's warrantless acquisition of numbers dialled and received. Snowden's first revelations dealt with the collection of phone records from Verizon. In The Wire, drug dealers used burner phones not because they didn't want law enforcement to know where they were, but so the numbers dialled and received couldn't be tracked and their calls couldn't be wiretapped -- the latter of which requires a warrant. Even her statement that police TV shows have long shown officers determining someone's location by "triangulating signals" is a false equivalent, as that method requires officers on the move attempting to locate one person at a specific time -- which is nothing like obtaining weeks or months-long records of their travels.

Judge Pepper finds the Fourth Circuit's finding baffling, but only because she frames this as a logical leap all cell phone users should have made: that what they share with phone companies is also shared with the government.

This court also is puzzled by the Graham court’s assertion that an individual has a reasonable expectation of privacy in cell tower data because she does not know which cell towers transmit the communications, or where they are located. Cell users know that they need to be in some sort of proximity to a tower in order to have cellular service. Those who drive specific routes each day to work know well the spots where they’re likely to lose service, and where they will regain it. Subway riders know why they lose service when they enter the tunnels. Perhaps cell users do not know, at the moment they discover that they have reception, where the tower is located. But users of cell phones know, at all times, that if their phone is connected to a network, they’re in some kind of proximity to a tower, and that if it is not connected, they likely aren’t.

Again, this says nothing about whether the average person believes their interactions with their service providers are just between these two parties. The government usually isn't considered to be interchangeable with the third parties people enter into voluntary relationships with. Knowing that you must be connected to a cell tower to make calls or use data is not the same thing as knowing the government can obtain this information with little to no difficulty/paperwork.

In decisions like these, the "reasonable expectation of privacy" is based solely on what the government feels is "reasonable" -- far removed from the average citizen's view of what is "reasonably" private information.

Filed Under: csli, privacy, third party doctrine

Federal Judge Says Third Party Doctrine A Perfectly 'Good Law;' No Warrants Needed To Obtain Cell Location Records

from the multiple-government-agencies-agree! dept

Back in December, a Connecticut state court ruled that tracking people in near-real time with cell site location info required the use of a warrant. Three months later, a Connecticut federal court has ruled law enforcement can obtain CSLI without a warrant, in bulk and for extended periods of time. While the opinion doesn't address the use of subpoenas and CSLI as a makeshift Stingray (for real-time tracking), it does come down firmly on the side of the government's interpretation of the Third Party Doctrine.

Here, the Government acquired information about defendant that was in the possession of a third-party—Verizon—and that the acquisition of this information did not involve any trespass upon defendant’s body, house, papers, or effects and did not involve any interference at all with defendant’s possessory interests in any of his property.

The opinion leans heavily on every decision finding that there's no expectation of privacy in records held by third parties. The court makes the slightest nod to the current discussion of expectations of privacy in a world where the devices most people carry generate a wealth of information and data nearly non-stop. But it does so with wording that shows it has no interest in engaging in this discussion.

The third-party doctrine has been subject to tsunamis of criticism. But it doubtlessly remains good law today.

And, like other decisions along the same lines, the court echoes the government's assertions that every cell phone user is perfectly aware their phones are sending all sorts of information to the nearest cell tower.

Defendant also contends that cell-site location information is not voluntarily conveyed to one’s cellular telephone company in the same sense or manner that one voluntarily conveys financial information to a bank as in Miller or telephone numbers to a telephone company as in Smith. Although this rationale has convinced some courts to conclude that the third-party doctrine does not apply, I do not agree. Every cell phone customer knows that his or her information is relayed wirelessly to nearby cell phone towers. It can come as no surprise that one’s cell phone company keeps records of cell towers that are accessed by and necessary to the provision and connection of every customer’s cell phone service. This is no different than every customer’s awareness that the bank keeps records of one’s checks and transactions (Miller) and that the telephone company keeps records of the telephone numbers that one calls (Smith).

The court also points out there's no bright line determination as to how much is too much when it comes to acquiring location records. (The defendant raised the argument that 22 days of CSLI was excessive without the use of a warrant.) As the court logically points out, any determination on an acceptable time frame would be completely arbitrary and mostly useless.

As for the Third Party Doctrine's possible inapplicability in today's world, the court says that's up to Congress to fix, not the courts.

All that said, the critics of the third-party doctrine have strong arguments it does not adequately protect privacy—that it imposes an unacceptable and Orwellian cost of forfeiture of any claim of privacy to what we voluntarily disclose even in confidence to one another. The critics persuasively argue that the doctrine is especially problematic in our ever expanding technology-dependent and technology-intrusive society. But these are arguments for policymakers in Congress to consider, if Congress wishes to enact protections that exceed the Fourth Amendment baseline.

[...]

In the meantime, the obligation remains for the lower courts to follow the law and not to impose—no matter how techno-intellectually fashionable—an “everything is different because it’s an iPhone” theory of the Fourth Amendment.

The issue of real-time warrantless tracking remains unaddressed as this case only dealt with historic data. The question of the Third Party Doctrine is punted back to Congress -- which has proven mostly uninterested in updating outdated laws to better conform to today's reality. Even with a boot up the ladder to a higher court is unlikely to result in a re-reading of the Third Party Doctrine. The Supreme Court has only determined that long-term location tracking might need a warrant. As it stands now, the acquisition of third-party records violates no one's privacy, legally-speaking.

Filed Under: 4th amendment, cell site location info, connecticut, csli, mosaic theory, privacy, third party doctrine

Connecticut Judge Says Cops Can't Get Real Time Cell Site Location Info Without A Warrant

from the which-apparently-law-enforcement-already-knew dept

It's a lower-level decision but it still means something. Well, a couple of somethings. First off, it appears Connecticut law enforcement probably shouldn't continue seeking "live" cell site location information without a warrant. It also appears the law enforcement agency involved doesn't have access to a cell site simulator (Stingray, etc.).

New Haven Superior Judge Jon Blue agreed to suppress evidence in an ATM robbery case, saying it was the result of Connecticut State Police improperly asking in advance to receive periodic live updates from the phone company of the location of the suspect’s cellphone

The Monday ruling comes in the case of Terrance Brown, 29, of Stratford, who was charged with robbing several automated bank teller machines in 2010.

T-Mobile was ordered to provide the location of Brown’s cellphone every 10 minutes during the time police were tracking him.

This sort of collection is nothing new. Many law enforcement agencies act under the belief that location information is just another business record, subject to fewer restrictions and a lower level of privacy protections. Generally speaking, courts have found the acquisition of historical cell site location data without a warrant to have minimal impact on Fourth Amendment protections. Using this information as a tracking device, however, has generated plenty of friction in the judicial system, something that probably won't be resolved until the Supreme Court tackles it.

In this case, the presiding judge found that the omnipresence of cellphones wasn't supposed to be viewed by law enforcement as a bold new world of exploitable tracking devices.

“The convenience of cellphones is well known; it is increasingly rare to meet someone who doesn’t carry one on his or her person,” Blue wrote. “But with this convenience comes the possibility of an Orwellian state.”

Currently, the state's laws only demand law enforcement offer "reasonable, articulable suspicion" in exchange for phone records, including location info. (This is the same standard the NSA is "held" to in its acquisition of phone records.) The ACLU would like to see that raised to "probable cause," but it's going to be an uphill battle against reams of legal precedent. Circuit splits on the issue of whether location data should be considered a business record complicate the matter, but for the most part, jurisprudence suggests location data -- especially historical location data -- may act as an ad hoc tracking device but still somehow lands outside of the Fourth Amendment's protections.

But using a phone as a GPS stand-in isn't quite the same thing, not when law enforcement is issuing subpoenas demanding periodic updates on futurelocation pings. Judge Blue notes the case's prosecutors admitted state law does not permit the warrantless tracking of individuals via their cellphone providers. Not that this admission means much when weighed against law enforcement's actual actions.

Using a 2005 "update" to a telecommunications record statute (referred to by some as Connecticut's Patriot Act), law enforcement could secure "ex-parte" orders to obtain phone records and communications. All that's required is reasonable suspicion. And use these orders law enforcement did -- more than 14,000 times since the law was enacted. An attempt to restore the warrant requirement died this summer in the state's legislature. Perhaps the judge's decision here will prompt legislators to take another run at restoring some Fourth Amendment protections to cell phone records.

However, the lack of a prosecutorial challenge suggests law enforcement knows the law doesn't specifically grant it the power to perform real-time tracking of individuals without warrants. Then again, knowing this didn't stop it from doing it, and the end result is the loss of its collected evidence, and most likely the case itself.

Filed Under: 4th amendment, cell site location info, connecticut, csli, jon blue, location info, warrant

Defendants Counter Government's Arguments That Appeals Court Should Treat Cellphones As 'Personal Homing Beacons'

from the government-still-thinks-it's-1979 dept

A couple of weeks ago, the government petitioned the Fourth Circuit Court of Appeals for an en banc rehearing of its decision finding that the acquisition of historical cell site location information (CSLI) requires a warrant. The government used many of the arguments the dissenting opinions did -- mainly that CSLI should still be considered a "business record" under the Third Party Doctrine.

It argued that while the court had held that cellphone users do not voluntarily convey location data when they use their phones, they also do not affirmatively agree to provide service providers with time, date, number called and length of the phone. These are all just parts of how service providers do business. With this argument, the government hopes to equate the tracking technology of modern cellphones with the simple phone records created by landlines -- the latter of which can be obtained without a warrant.

Obviously, the two types of data are nothing alike. Landlines don't generate location information because they're in a fixed position. Cellphones -- on top of creating location records whenever a call is placed -- also create continuous location data as they hop towers to obtain signals, even while the phone is not in active use.

The defendants in the original case have filed their opposition to the government's request for a rehearing, arguing (naturally) that the court came to the correct decision the first time around.

The panel correctly decided that tracking a person using historical cell site location information (CSLI) for 221 days, without a warrant or probable cause, is dragnet surveillance that the Fourth Amendment prohibits. See United States v. Jones, 132 S. Ct. 945, 952 n.6 (2012). The government is essentially asking this Court to treat cell phones as personal homing beacons, providing it the wherewithal to follow and recreate a person’s every movement. The government seeks to do so without a warrant or probable cause, using the excuse that telecommunications providers also happen to know when and where an individual has gone and is going.

The difference between what the government did here and what George Orwell envisioned is that Big Brother’s constant surveillance through telescreens was stationary. But the surveillance here moves with citizens using a common household device carried in the pockets or purses of almost every American adult. Our Founders crafted the Fourth Amendment to require a warrant based on probable cause before the government could acquire such intimate information about a person. The panel’s conclusion that the government must comply with the warrant requirement before obtaining historical CSLI correctly applies the Fourth Amendment.

More to the point, the filing argues that the government's purported reason for the rehearing request is flawed in and of itself. The government noted the circuits are split in their opinions of CSLI's Fourth Amendment implications. The government says a rehearing will "resolve" the current circuit split. The defendants point out that a rehearing will do nothing of the sort, no matter how the court resolves its own differences from its first (divided) opinion. That's up to the nation's highest court to settle, should such a petition be granted.

While it is true that the majority opinion conflicts with decisions from the Fifth and Eleventh Circuits regarding the applicability of Smith and Miller and the third party doctrine, these courts had already split with the Third Circuit. The Eleventh and Fifth Circuits held that individuals have no reasonable expectation of privacy in historical CSLI because, under Smith and Miller, individuals voluntarily disclose their location data to cellular service providers…

These splits existed before the panel’s decision. The panel thoroughly addressed all the different positions in its 134-page opinion. If any further review of this issue should occur, it should be in the Supreme Court, the only forum that can clarify the fractured state of the law. A petition for certiorari is already pending in Davis, which, if granted, would resolve these splits.

The opposition filing also notes that while the government cites several court decisions in support of its Third Party Doctrine-based arguments, it relies on nothing more current than 1979's Smith vs. Maryland -- the decision that upheld the warrantless acquisition of call routing data via pen register orders. In doing so, it bypasses the most recent Supreme Court decisions on cellphones and warrants: Riley and Jones.

Riley v. California establishes that individuals have a privacy interest in historical CSLI. 134 S. Ct. 2473, 2490 (2014). Historical CSLI generated by cell phones served as one of the Court’s chief examples of “the privacies of life” included in cell phone metadata. The Court described just how intimate and detailed location data is: “Data on a cell phone can also reveal where a person has been. Historic location information . . . can reconstruct someone’s specific movements down to the minute, not only around town, but within a particular building.” Id. The Court explained the intrusive nature of CSLI tracking by adopting Justice Sotomayor’s concurrence in United States v. Jones, 132 S. Ct. 945, 955 (2012). The unanimous Riley Court thus concluded that monitoring “a precise, comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations” infringes upon an individual’s reasonable expectation of a privacy that is protected by the Fourth Amendment.

These findings are echoed in the appeals court's decision, but the US government wants those conclusions rolled back. A patchwork of conflicting opinions on CSLI and the Fourth Amendment won't be resolved until the Supreme Court addresses the issue directly, but until then the government apparently would like to keep its warrantless options open.

Filed Under: 4th amendment, cell site location info, csli, doj, location info, mobile phones, warrants

Cops Dodge Warrant Requirement By Grabbing Two Weeks Of Data, But Entering Only 6 Hours Of It As Evidence

from the too-clever-by-much-more-than-half dept

Today's novel legal argument: take a ruling on cell site location info warrant requirements and make it fit the warrantless data haul obtained earlier by submitting only the "quantity" the court has previously OKed.

To get a sense of where we're going with this, here's a bit from the opening paragraphs of the opinion:

The defendants, Jason Estabrook and Adam Bradley, stand indicted for murder and related crimes arising out of a shooting that took place on July 7, 2012, in Billerica. They moved to suppress evidence of historical CSLI pertaining to Bradley's cellular telephone that the police initially obtained in July, 2012, without a search warrant but in compliance with 18 U.S.C. § 2703 (2006), and then, in November, 2013, reobtained pursuant to a warrant.

The CSLI was sought twice. This is the first sign that something's not quite right. Historical cell site location information doesn't change. That's the thing about history. And yet, the police obtained it twice: once with a subpoena (which was wrong) and once with a warrant (the lawful way to do it).

You see, the Massachusetts courts had already created a bright-line (of sorts) for the acquisition of cell site location data. Under the state's interpretation of its Declaration of Rights, cell site location info carries with it a reasonable expectation of privacy. This status demands the use of a warrant. An earlier decision determined that small amounts (up to six hours) of CSLI can be obtained without a warrant, as the limited time period makes acquisition much less analogous to long-term tracking.

The police knew they could only get six hours of CSLI without a warrant, but they had already grabbed two week's worth using only a subpoena. But the officers had an angle…

In this case, however, because the Commonwealth requested two weeks of historical CSLI, a search warrant was required, even though the Commonwealth proposes to use only six hours of the CSLI as evidence at trial.

That's a very opportunistic reading of the court's intentions. If the police were so inclined, they could subpoena a year's worth of CSLI and trim it down to only the most incriminating six hours of data before presenting it in court. Or they could just go fishing with subpoenas, look over the collected data and see if they could match any six hours of it to an investigation or prosecution.

The court points out the flaw in this logic, which, let's face it, the cops knew all along.

It is important to emphasize that, in terms of reasonable expectation of privacy, the salient consideration is the length of time for which a person's CSLI is requested, not the time covered by the person's CSLI that the Commonwealth ultimately seeks to use as evidence at trial.

The warrant requirement is for the "asking," not the "telling," to put it elementary school terms.

Fortunately for the police, the twice-obtained CSLI didn't harm their case too much. The defense argued that other evidence -- including statements made to the police -- should be suppressed because it originated from tainted CSLI. The court, however, concludes that a great deal of evidence was obtained independently and that only a few moments from various interviews could be traced back to inferences drawn from the cell site location info.

The court also came to the conclusion that the warrant the police sought well after it already had the subpoenaed CSLI in hand was likely legitimate, rather than just a shoddy attempt to cover up its earlier misdeed. Over the course of several paragraphs, the court lists all of the information gathered by officers prior to their issuing of the subpoena and finds it adds up to probable cause that isn't overly-reliant on the already-acquired CSLI info. The court doesn't offer any speculation as to what actually happened here, but rather points out that the CSLI was still lawfully-obtained, and anything stemming from the latter acquisition cannot be suppressed.

While this obtain-twice, admit-once method of cell site evidence acquisition didn't pay off for the criminal defendants, it at least provides another citable example of how far law enforcement agencies are willing to go to bypass the mild logistical hiccup that is obtaining a warrant.

Filed Under: 4th amendment, adam bradley, cell site location info, csli, data, jason estabrook, location info, massachusetts, seizure, warrants