EFF, Human Rights Watch Sue The DEA Over Mass Surveillance Program

from the good-timing dept

Well, that was quick. As we noted, just yesterday, USA Today published a detailed takedown of the DEA's massive phone records mass surveillance program that was actually started more than two decades ago. And this morning, the EFF, representing Human Rights Watch, filed a lawsuit over the program. Of course, the program had actually been revealed years ago, and back in January, the US government revealed some details itself about the program, which is what prompted the new lawsuit. As the EFF notes in its press release about the lawsuit:

“The DEA’s program of untargeted and suspicionless surveillance of Americans’ international telephone call records—information about the numbers people call, and the time, date, and duration of those calls—affects millions of innocent people, yet the DEA operated the program in secret for years,’’ said EFF Staff Attorney Nate Cardozo. “Both the First and Fourth Amendment protect Americans from this kind of overreaching surveillance. This lawsuit aims to vindicate HRW’s rights, and the rights of all Americans, to make calls overseas without being subject to government surveillance.”

I recommend reading the full complaint which has more details. It details why the program violates both the First and Fourth Amendments. The basic First Amendment argument:

By their acts alleged herein, Defendants have violated and are violating the First Amendment free speech and free association rights of Plaintiff and its staff, including the right to communicate anonymously, the right to associate privately, and the right to engage in protected advocacy free from government interference.

And the Fourth Amendment argument:

By the acts alleged herein, Defendants have violated Plaintiff’s reasonable expectation of privacy and denied Plaintiff its right to be free from unreasonable searches and seizures as guaranteed by the Fourth Amendment to the Constitution of the United States.

It seems likely that the government will pull out all the usual stops to try to end this lawsuit, arguing "national security" and "state secrets" and all that jazz. However, as the USA Today report noted, Eric Holder agreed to kill off this program after realizing that it was nearly impossible to defend in the same manner as the feds were trying to defend the NSA's bulk phone records collection...

Filed Under: 1st amendment, 4th amendment, dea, first amendment, fourth amendment, lawsuit, mass surveillance, metadata, phone records, surveillance
Companies: eff, human rights watch

Google Files Legal Challenge To Attorney General Jim Hood's Subpoenas

from the well,-well dept

This story sure escalated in a hurry. Following all the news of the MPAA's tight relationship with Mississippi Attorney General Jim Hood, Google has made a filing in a Mississippi federal court seeking seeking a temporary restraining order and an injunction against Hood's investigation. As the filing notes:

For the last eighteen months, the Mississippi Attorney General has threatened to prosecute, sue, or investigate Google unless it agrees to block from its search engine, YouTube video-sharing site, and advertising systems, third-party content (i.e., websites, videos, or ads not created by Google) that the Attorney General deems objectionable. When Google did not agree to his demands, the Attorney General retaliated, issuing an enormously burdensome subpoena and asserting that he now has “reasonable grounds to believe” that Google has engaged in “deceptive” or “unfair” trade practice under the Mississippi Consumer Protection Act (MCPA), which allows for both civil and criminal sanctions. The Attorney General did so despite having publicly acknowledged in a letter to Congressional leaders that “federal law prevents State and local law enforcement agencies from prosecuting” Internet platforms. The Attorney General took these actions following a sustained lobbying effort from the Motion Picture Association of America.

As Google explains, there is no legal basis for this investigation:

First, Section 230 of the Communications Decency Act (“CDA”) precludes state regulation of Google based upon the third-party content available on its services or the manner in which Google moderates that content. “Congress provided broad immunity under the CDA to Web-based service providers for all claims stemming from their publication of information created by third parties.” Doe v. MySpace, Inc., 528 F.3d 413, 418 (5th Cir. 2008).

Second, the First Amendment protects Google’s organization and display of third-party information (e.g., search results), prohibits retaliation for how it organizes and displays such content, and bars state action that limits public access to constitutionally-protected speech. As multiple courts have found, the state can no more tell a search engine what results to publish than it can tell a newspaper what editorials to run. See, e.g., Jian Zhang v. Baidu.com Inc., 10 F. Supp. 3d 433, 436, 438 (S.D.N.Y. 2014). Nor can the state “encourag[e] the suppression of speech in a manner which can reasonably be interpreted as intimating that some form of punishment or adverse regulatory action will follow the failure to accede to the official’s request.” Zieper v. Metzinger, 474 F.3d 60, 65-66 (2d Cir. 2007) (internal quotation marks omitted).

Third, the subpoena violates the Fourth Amendment by demanding information about conduct that is plainly lawful. “[I]nvestigations premised solely upon legal activity are the very type of ‘fishing expeditions’ that” the Supreme Court has held violate the Fourth Amendment and “do[] not pass muster under any standard.” Major League Baseball v. Crist, 331 F.3d 1177, 1187-88 (11th Cir. 2003) (citations omitted).

Fourth, much of the Attorney General’s subpoena is preempted by the Copyright Act or the Food, Drug and Cosmetics Act (“FDCA”). Many of the Attorney General’s inquiries concern copyright infringement—but copyright is exclusively a matter of federal law, which the Attorney General may not enforce and with which Google fully complies. See GlobeRanger Corp. v. Software AG, 691 F.3d 702, 705-06 (5th Cir. 2012). Similarly, the Subpoena seeks information about Google’s practices ten years ago with regard to advertisements relating to the importation of prescription drugs. But the FDCA regulates importation of prescription drugs and preempts enforcement actions not brought “by and in the name of the United States.” 21 U.S.C. § 337. omitted).

In short, Jim Hood is on a massive fishing expedition over things he doesn't understand, over which he has no jurisdiction, for issues where Google fully complies with the law. The filing further notes that, yes, there is bad content on the internet, but that Google actually is extraordinarily active in pushing it down in its search results and seeking to stop people from accessing that content. But, its voluntary efforts are very different from being required to change its search results via an order from a government official:

But if a state Attorney General can punish, irrespective of well-established federal law, any search engine or video-sharing platform whenever he finds third-party content he deems objectionable, search engines and video-sharing platforms cannot operate in their current form. They would instead have to pre-screen the trillions of websites and millions of videos on the Internet, blocking anything they had not yet reviewed from being publicly accessible so as to avoid the ire of even a single state or local regulator. This would “severely restrict the information available on the Internet,” Batzel v. Smith, 333 F.3d 1018, 1027-28 (9th Cir. 2003), precisely the opposite of the “unfettered” Internet the CDA and the First Amendment protect. The Attorney General may prefer a pre-filtered Internet—but the Constitution and Congress have denied him the authority to mandate it.

Google further lists out the various threats and statements Hood has made:

In several letters to Google, the Attorney General has falsely accused it of, among other things, “aiding and abetting” and even “encourag[ing] . . . illegal activity.” Id. Ex. 5 at 3. He has characterized Google as an “accessory before the fact” in criminal conduct, id. Ex. 2 at 1, asserted it has “no corporate conscience for the safety of its customers,” id. Ex. 17 at 1, and claimed that Google “facilitates and profits from numerous illegal online activities,” id. Ex. 17 at 2. See also id. Ex. 15 at 3 (page 1 of the draft letter). He has threatened to “take legal action to change [Google’s] behavior,” id. Ex. 2 at 3, outlining “[p]ossible [c]auses of [a]ction” against Google in a presentation to the National Association of Attorneys General (“NAAG”), id. Ex. 10 at 53-57, sending numerous requests for information, see, e.g., id. Exs. 1, 5, & 22, and a broad litigation hold notice, id. Ex. 8. The Attorney General has demanded in several meetings that Google pre-screen or block third-party content and search results that merely may involve illegal activity, even at the cost of burdening lawful, protected speech. See, e.g., id. Ex. 2 at 2; id. Ex. 22 at 2; id. Ex. 27 at 5:13-6:24, 7:16-8:14. He has even sought a “24-hour link through which attorneys general[]” can request that links to particular websites be removed from search results “within hours,” presumably without judicial review or an opportunity for operators of the target websites to be heard. Id. Ex. 5 at 3.

That last one is crazy. Hood is flat out demanding a tool for government officials to censor the internet, based solely on those officials' requests.

The Attorney General has cited no evidence at all of misconduct by Google to back up these inflammatory allegations. He has instead identified a handful of web pages among the trillions reflected in Google’s index, and a smattering of videos amongst the millions of hours watched every month on YouTube, and asserted that some of the content of those websites and videos (all created by third parties) is unlawful.... He has noted that advertising occasionally appears alongside the videos about which he complains.... And he has criticized some of Autocomplete’s algorithmically-generated predictions.

Whatever that says about the actions of those who created and developed the content about which the Attorney General complains, it in no way implies that Google has violated the law. Given the vast quantity of third-party content available on the Internet, it is no surprise that some small percentage of the information found via Search or posted on YouTube is inappropriate or unlawful. Statutes such as the CDA and DMCA accept the inevitability of problematic content online as the cost of a free and open Internet, and squarely immunize Google and other interactive service providers from liability arising from such third-party content.

Furthermore, Google debunks the notion that it has done nothing to deal with such sites:

Nevertheless, Google has worked to address the Attorney General’s concerns.... In response to his questions, Google provided over one-hundred pages of written answers detailing its policies and practices for voluntarily combating abuse across its services, and voluntary shared nearly 100,000 pages of supporting documents. YouTube engineers even created a custom reporting tool and trained the Attorney General’s office on how to use it so that they could report for expedited review and possible removal videos they deemed objectionable.... To date, over half a year later, the Attorney General has used this tool to report only seven videos.... Nor, to the best of Google’s knowledge, has the Attorney General filed any legal action against any of the actual creators of the specific underlying content to which he has objected. Google has also explained the applicability of CDA immunity and the DMCA safe-harbor provisions to services like Google, as well as the constitutional concerns raised by his demands

That part I bolded is the key. It shows the reality of the situation, which is that Hood isn't really trying to stop bad content online, no matter how many times he argues otherwise -- he's just attacking Google.

There's much more in the filing, including arguing that Hood is violating the First Amendment directly in his most recent subpoena to Google:

The Attorney General has made clear that he disagrees with how Google exercises editorial judgment in the composition of its search results and YouTube content, and wishes to force Google to adopt editorial judgments that he would prefer. For content he disfavors, he asks that Google censor from search results links to websites that are readily available on the Internet, regardless of whether any court has found them unlawful, and has even gone so far as to demand that certain search terms themselves be banned.... The Attorney General has also demanded that links to disfavored content be demoted in search rankings and marked with a warning to users.... Conversely, he has asked Google to promote favored content (e.g., Hollywoodapproved websites) by raising its standing in search results and indicating its favored status with an icon.... Such demands by a government official to displace a private party’s editorial judgment in order to favor certain speech or speakers over others strike at the heart of the First Amendment.

And, of course, just because some of the content targeted may not be protected, that doesn't relieve the First Amendment problems:

State enforcement actions targeting unprotected speech can violate the First Amendment by limiting the “public’s access to constitutionally protected matter.” Smith v. People of California, 361 U.S. 147, 153 (1959). A state may not penalize a bookseller for unknowingly offering obscene material because he would then “tend to restrict the books he sells to those he has inspected,” and the limits on his ability to inspect content would “tend to restrict the public’s access to [content] which the State could not constitutionally suppress directly.” .... Similarly, a state may not sanction a magazine for unknowingly publishing unlawful advertisements because “publishers cannot practicably be expected to investigate each of their advertisers,” and the risk of sanction could lead a publisher to reject advertisements that “could conceivably be deemed objectionable by the [government],” which would deprive the public of access to protected speech, and the potential advertisers an “avenue of access to the public.” MANual Enters., Inc. v. Day, 370 U.S. 478, 493 (1962).

There's a lot more in there, but those are some of the high points. Hood has been provoking Google (at the behest of the MPAA and others) for a long time. It appears that Google has hit back.

Filed Under: copyright, dmca, first amendment, fourth amendment, free speech, injunction, jim hood, secondary liability, section 230, subpoena, temporary restraining order
Companies: google, mpaa

EFF And ACLU Explain To Tennessee School Board That Its New Internet Policy Violates Both The 1st & 4th Amendments

from the a-twofer dept

We've seen over and over again recently that schools seem to have a bizarre notion of how the First Amendment works with things like "free speech zones" and the like. There are all sorts of policies popping up that try to ban free speech. In perhaps the most famous court case concerning free speech in schools, Tinker v. Des Moines, the Supreme Court noted, importantly, that students do not shed their constitutional rights just because they've entered a school building. More recently, the courts have (tragically) chipped away at that ruling, but the core of it still stands. And schools still don't seem to realize that it's true. Instead, they seem to want, increasingly, to regulate speech of students in completely unconstitutional ways.

Over in Tennessee, the EFF and the ACLU have teamed up to challenge a new school board policy from the Williamson County Board of Education, which is something of a twofer: not only does it violate the First Amendment, but the Fourth Amendment as well. The policy is the school's "Acceptable Use, Media Release, and Internet Safety Procedures and Guidelines" that effectively bar students from ever saying anything the school deems "inappropriate" or "unauthorized" on any computer equipment that they bring to school (even if the speech is done off-campus) and also make all of the students subject to searches of their devices and monitoring of what they do online. Here's the short summary from the letter (which is quite detailed and runs 10 pages long):

Of particular concern are (i) the social media guidelines applicable to students when engaged in off-campus speech; (ii) the "Bring Your Own Technology" guidelines, pursuant to which students are required to consent to suspicionless searches of their electronic devices "at any time" for any "school- related purpose"; and (iii) the network security and email guidelines, pursuant to which all data and communications of network users are subject to suspicionless monitoring.

While the Policy may be the product of a well-intentioned effort to ensure student safety and network security, and to ensure that classrooms are not disrupted, the Policy goes too far and, as written, violates students' constitutional rights. It (a) functions as a prior restraint on speech, allowing school officials to censor student speech in and out of school, and (b) permits officials to conduct suspicionless searches of (i) any electronic devices that students bring to school and (ii) all data and communications stored or transmitted on the WCS network. In so doing, the guidelines overstep the school district's authority and impermissibly burden the First and Fourth Amendment rights of WCS students. As the United States Supreme Court famously held in the landmark case Tinker v. Des Moines Independent Community School District, students do not "shed their constitutional rights . . . at the schoolhouse gate."

Let's hope the school district recognizes its mistake, otherwise it appears that there may be a legal challenge to the policy coming up shortly.

Filed Under: first amendment, fourth amendment, free speech, policy, schools, social media, tennessee
Companies: williamson county schools

The Supreme Court Has Just Given The Police Another Way To Search Your House Without A Warrant

from the 4th-amendment-now-mostly-holes dept

A few days ago, the Supreme Court handed down a decision that effectively grants law enforcement and investigative agencies the power to search your home without a warrant. Here's what led to this unfortunate bit of precedent.

At issue in Fernandez v. California was a 2009 search by the Los Angeles Police Department of the home of a robbery suspect. When the officers first arrived, suspect Walter Fernandez denied them entry, but because his girlfriend Roxanne Rojas exhibited signs of recent injury, Fernandez was arrested on separate charges of domestic violence. While Fernandez was being booked, one of the officers returned to the apartment and gained Rojas’ permission to conduct a search, which soon turned up evidence linking Fernandez to the robbery.

Writing for a 6-3 majority, Justice Samuel Alito upheld the LAPD’s actions. “A warrantless consent search is reasonable and thus consistent with the Fourth Amendment irrespective of the availability of a warrant,” Alito wrote. Moreover, he added, “Denying someone in Rojas’ position the right to allow the police to enter her home would also show disrespect for her independence.”

On one hand, this does make some sense. Multiple adult occupants should have some stake in control of the residence. But as Fernandez pointed out in his arguments, his refusal to let the police search the apartment without a warrant was disregarded once he was in custody. Fernandez felt his objection should still stand despite being arrested. (And one would think it would -- police still need a warrant to search the premises of arrested individuals.) Because he was no longer at the residence to object, the police went back and got permission for a warrantless search from his girlfriend.

The court argues somewhat elliptically (quoting from 2006's Georgia v. Randolph) that because Fernandez was no longer there to object, any "reasonable person" would have felt confidence in accepting the remaining individual's invitation to search the premises.

“[I]t is fair to say that a caller standing at the door of shared premises would have no confidence that one occupant’s invitation was a sufficiently good reason to enter when a fellow tenant stood there saying, ‘stay out.’ Without some very good reason, no sensible person would go inside under those conditions.” Id., at 113.

It seems obvious that the calculus of this hypothetical caller would likely be quite different if the objecting tenant was not standing at the door. When the objecting occupant is standing at the threshold saying “stay out,” a friend or visitor invited to enter by another occupant can expect at best an uncomfortable scene and at worst violence if he or she tries to brush past the objector.

But when the objector is not on the scene (and especially when it is known that the objector will not return during the course of the visit), the friend or visitor is much more likely to accept the invitation to enter. Thus, petitioner’s argument is inconsistent with Randolph’s reasoning.

But cops are neither "friends" nor "visitors." They are government officials in possession of a great deal of power. And they are supposed to obtain warrants to search premises if there's an objection. The conclusion the court reaches here has effectively given law enforcement (yet another) route around the Fourth Amendment.

If one person objects, but the other says "yes," then all the police have to do is detain the objector and search the residence with the other person's permission. The court cautions against meritless detainment and states that evidence obtained in this underhanded fashion will be less likely to hold up in court. But that's a statement the court has to want to believe to defend its conclusion. There is simply no reason to believe that any law enforcement officer won't be able to find some charge to throw at the objector in order to remove them from the equation. Even if the arrest turns out to be spurious and used solely to remove the objector, the objector still has to suffer through detainment, and then, if the search turns up anything, fight to get the illicitly-obtained evidence thrown out. Neither of these are pleasant for the person who simply decided to assert his Fourth Amendment rights.

The dissenting opinion correctly notes that the majority's decision shrinks the protections of the Fourth Amendment. Judge Ruth Bader Ginsburg writes:

“Instead of adhering to the warrant requirement, today’s decision tells the police they may dodge it, nevermind ample time to secure the approval of a neutral magistrate.”

The "ample time" is an excellent point. Fernandez was arrested. He wasn't going anywhere, so the police had plenty of time to secure a warrant without worrying that the detainee would destroy evidence. But they chose not to. And they took this case all the way to the Supreme Court.

How hard is it to get a warrant? In court, agencies act like it's a nearly insurmountable obstacle, when in fact (in most jurisdictions), it's rarely more than a rubber stamp process. Very rarely does any judge challenge law enforcement officers' claims made "upon information and belief." If time is absolutely of the essence, there are emergency exceptions which can be used (and often, abused).

But law enforcement and investigative agencies don't like obtaining warrants. Despite this protection being a part of this country for nearly its entire existence, these entities have worked tirelessly to eliminate the small requirement that they show probable cause before performing searches. Gideon at A Public Defender quotes yet another law enforcement official talking about the terrible hardship that is securing a warrant.

“I mean, it’s like, oh my gosh, as if!” said Wethersfield, CT police chief James Cetran when asked whether obtaining cell phone records of citizens of Connecticut should require a showing of probable cause. Warrants based on probable cause are, like, so “tedious”, he followed up. Further:

“It makes things faster, easier and better for us,” said Cetran. “It’s something you can do within minutes, not hours.*

“Best of all, of course, would be no requirement to get a pesky judge involved, but I’m feeling like a fat cat from where I’m sitting already, so…” he most certainly did not say, but I’m going to pretend that he thought it to himself nonetheless.

*Gideon from A Public Defender feels it should be noted that this quote was the only thing Chief Cetran actually said. Everything else surrounding it is Gideon's embellishment.

These entities already have warrantless access to tons of data and they're still not satisfied. The following is a small list of the information available to law enforcement, investigative and security agencies without a warrant. (There are, of course, some exceptions state-to-state.)

Call records
License plate data
Cellphone location data
Hotel/motel registration
Drug prescription data
Email over 180 days old

Almost anything considered a "business record" can be obtained without a warrant thanks to the Third Party Doctrine. The contents of your cellphone may be accessed without a warrant, thanks to courts comparing cellphone contents to the contents of your pockets or address books. Every agency in the nation has some form of "exigent circumstances" exceptions to use instead of warrants, which further weakens the Fourth Amendment.

As Gideon points out, the state of Connecticut already has a built-in workaround for police to (ab)use to skirt the Fourth Amendment.

In Connecticut, unlike, say, in MA [PDF], police departments can obtain cell phone records of anybody by getting a judge to sign an “ex parte application.“

The difference is that the ex parte application merely requires a showing of ‘reasonable and articulable suspicion’, which is the standard that police need to meet in order to stop you on the street and ask you a question, as opposed to ‘probable cause’, which is what they need to search you, your house, your car, or to arrest you. It’s a much lower standard and one that’s only slightly higher than “because I felt like it”...

Which brings me to the second thing: as per Colli’s report, it seems that of the 13,000+ ex parte applications made since 2005, not a single one has been rejected.

Not one in over 8 years. And you think the FISA court was an NSA rubber stamp? Are you confident that all 13,000+ requests involved people whom the police had reason to believe were committing or had committed a crime?

Despite all of this warrantless access, agencies still complain that getting a warrant slows down the "process." The state of Massachusetts plans to appeal the recent state supreme court decision that stated that warrantless access to cellphone location data violates the state constitution by arguing that the law enforcement agency had enough probable cause to get a warrant. That's the state's trump card: because it could have obtained a warrant, it should be allowed to access this data without a warrant.

This logic is as horrendous as it is self-serving. State law enforcement agencies want this loophole left open because they want the freedom to grab records without having to worry about probable cause. The agency could have obtained a warrant, it still chose not to -- to grab historical data, no less, as if time was even a factor.

The Supreme Court has just carved another path around the inconvenient amendment, one that allows law enforcement to search your residence without a warrant or your permission. All they have to do is find one resident who will say, "yes." And while they perform this warrantless search, you'll be locked up. This tilts the power balance entirely. You, the citizen, will be completely stripped of the few rights you do have while law enforcement tosses your house for whatever it can find. The US Supreme Court has just cast its vote for the expansion of the police state and trimmed some more flesh from the desiccated body of the Fourth Amendment.

Filed Under: fourth amendment, police, privacy, supreme court

Massachusetts Court Rules That Warrantless Access Of Cellphone Location Data Violates State Constitution

from the hedged-with-a-handful-of-exceptions dept

The Massachusetts Supreme Court has restored a bit of its citizens' Fourth Amendment rights, even if the decision finding that law enforcement needs a warrant to obtain cellphone location data specifically doesn't address that. (via How Appealing)

The Supreme Judicial Court, ruling in a case with echoes of the controversy over the National Security Agency’s surveillance programs, said a warrant is required under the Massachusetts constitution protections against unreasonable search and seizure.

"It's an enormous victory for everybody in Massachusetts who cares about privacy,” said Matthew Segal, legal director of the American Civil Liberties Union of Massachusetts, which served as appellate counsel for the suspect in the case, Shabazz Augustine, who was being investigated in the 2004 homicide of his girlfriend, Julaine Jules of Malden…

In 5-2 ruling issued Tuesday, the state's highest court clarified the issues, providing both a clear definition of the privacy of phone records in the digital age, and also affording prosecutors a road map to using those records in their case against Augustine.

The court said it was possible that if the data covered only a short period, then obtaining the records under the federal Stored Communications Act without a search warrant might be acceptable. But it said it was clear that in Augustine's case, in which two weeks of data was obtained, the period was too long.

This was determined to be a violation of the state's constitution. The majority decision notes that cell site location information (CSLI) is much more revealing than the Third Party Doctrine anticipated. The court notes that CSLI is more intrusive than vehicular GPS tracking.

Indeed, as the defendant contends, because of the nature of cellular telephone use and technology, there is a strong argument that CSLI raises even greater privacy concerns than a GPS tracking device. In contrast to such a device attached to a vehicle, [...] because a cellular telephone is carried on the person of its user, it tracks the user's location far beyond the limitations of where a car can travel. See, e.g., United States vs. Powell, U.S. Dist. Ct., No. 12-cr-20052 (E.D. Mich. May 3, 2013) ("There are practical limits on where a GPS tracking device attached [to] a person's vehicle may go. A [cellular telephone], on the other hand, is usually carried with a person wherever they go"). As a result, CSLI clearly has the potential to track a cellular telephone user's location in constitutionally protected areas.

The court references the infamous pen register/trap and trace decision (Smith v. Maryland) that has served as the basis for warrantless access to phone records for everyone from local law enforcement to the NSA. But unlike FISA Judge Kollar-Kotelly's broad reading in favor of the Section 215 program, this court finds that the narrow scope of the original decision (outbound and incoming phone calls) doesn't stretch quite far enough to cover long-term warrantless access to a person's whereabouts as provided by CSLI.

CSLI is purely a function and product of cellular telephone technology, created by the provider's system network at the time that a cellular telephone call connects to a cell site. And at least with respect to calls received but not answered, this information would be unknown and unknowable to the telephone user in advance -- or probably at any time until he or she receives a copy of the CSLI record itself. Moreover, it is of course the case that CSLI has no connection at all to the reason people use cellular telephones. See Earls, 214 N.J. at 587 ("People buy [cellular telephones] to communicate with others, to use the Internet, and for a growing number of other reasons. But no one buys a [cellular telephone] to share detailed information about their whereabouts with the police").

Even if cellphones are handy tracking devices, it's really not considered a "selling point." The expectation of privacy in location data may have been eviscerated by an outdated decision (1979's Smith v. Maryland) and an aggressive application of the Third Party Doctrine, but the state Supreme Court sees no reason to continue ignoring the reality of today's cellphone-inundated world simply because that case's implications haven't been recently examined by the US Supreme Court.

But the court does seems to slip up when attempting to find the point when a constitutional search becomes an unconstitutional one (in terms of Massachusetts' state constitution, not the United States'). Rather than simply require a warrant for cell site location data, it instead asserts that the length of the search determines its constitutionality.

Nonetheless, we also recognize that in terms of the constitutional question raised, GPS data and historical CSLI are linked at a fundamental level: they both implicate the same constitutionally protected interest -- a person's reasonable expectation of privacy -- in the same manner -- by tracking the person's movements. Given this intrinsic link, it is likely that the duration of the period for which historical CSLI is sought will be a relevant consideration in the reasonable expectation of privacy calculus -- that there is some period of time for which the Commonwealth may obtain a person's historical CSLI by meeting the standard for a § 2703(d) order alone, because the duration is too brief to implicate the person's reasonable privacy interest. But there is no need to consider at this juncture what the boundaries of such a time period might be in this case because, for all the reasons previously rehearsed concerning the extent and character of cellular telephone use, the two weeks covered by the § 2703(d) order at issue exceeds it: even though restricted to telephone calls sent and received (answered or unanswered), the tracking of the defendant's movements in the urban Boston area for two weeks was more than sufficient to intrude upon the defendant's expectation of privacy safeguarded by art. 14.(37) Cf. Rousseau, 465 Mass. at 382 (no need to decide dimensions of individual's expectation "not to be subjected to extended GPS electronic surveillance by the government, targeted at his movements," because police GPS vehicle tracking for thirty-one days was sufficient to trigger defendant's reasonable expectation of privacy).

This is a problematic decision, as Orin Kerr points out at The Washington Conspiracy/Volokh Post.

As I wrote in my mosaic theory article, it will be interesting to see how courts turn this into rules. For example, if one week is short-term enough not to get a warrant, what happens when the investigators get two one-week court orders individually instead of one two-week order? But then this is only a decision that regulates one state, and doesn't apply at the federal level, so perhaps the issue won't come up often enough to open the Pandora's Box that I think the mosaic theory implicates.

The dissenting opinion also seems to misstep, at first almost affirming the assertions made by the majority.

[W]hile it may seem as if Americans are always talking on their cellular telephones, they are actually doing so less than two per cent of the day. Therefore, there is a world of difference between telephone CSLI and registration CSLI in terms of the location points they will reveal and the degree to which they will intrude on personal privacy…

I recognize that, because of the mobility of a cellular telephone, telephone call CSLI will provide many location points outside a user's home or place of business, and these location points may provide a patchwork that will intrude on the user's privacy to the extent that they reveal where the user is located when making or receiving calls on the telephone. But this patchwork of location points, while intrusive of privacy, is less intrusive than the patchwork of personal affiliations that can be learned from traditional telephone toll records. I also recognize that the degree of intrusion on privacy will depend on the number of calls the user makes and receives. But this is also true about traditional telephone records; the more telephone calls a person makes and receives, the more will be revealed regarding the persons the individual speaks with and the frequency of those calls.

The problem here is that there's no indication that only "telephone call CSLI" was sought or will be sought in the future. Even if this case deals with only phone call CSLI, the fact is that location data entirely unrelated to phone calls (and the pen trap/trace statute) is being accessed without a warrant as well. The dissenting opinion tries to portray CSLI as roughly equivalent to call records, even while admitting there's a huge difference between continuously-generated location data and the much more limited inbound/outgoing phone call data.

The question should be: why didn't law enforcement get a warrant? It sought two weeks of historical data, meaning time wasn't really of the essence. In fact, the spokesman for the state's district attorney's office says it could have easily obtained one:

"We expect to prove that the affidavit submitted in 2004 would just as easily have supported a search warrant," said Jake Wark, a spokesman for the Suffolk County District Attorney.

So, why didn't they get one? Is this Third Party Doctrine loophole too tempting to resist? If it had just obtained a warrant, it wouldn't have had to pursue this case through multiple courts and would have been able to use the information it obtained during prosecution. Instead, because it took the easy way out, it has to gear up for yet another legal battle to appeal the decision. Massachusetts taxpayers' should be irate that they're footing the bill for a pointless legal battle when the impetus for the case is a warrant that could have been obtained, but wasn't.

Filed Under: fourth amendment, location data, massachusetts, privacy, warrantless access

Oregon Police Push State Law-Violating ID Scanners On Nightclub And Bar Owners

from the and-then-claim-to-be-'not-responsible'-for-any-part-of-the-debacle dept

Oregon seems to be turning into a bastion of privacy, much to the chagrin of various law enforcement agencies. As we recently covered, a district court ruled that the DEA's warrantless access of its drug prescription database (achieved through "administrative subpoenas" that require no judicial approval or probable cause) was unconstitutional. In Oregon, at least, it appears our nation's foremost drug warriors will need to comply with the Fourth Amendment.

Now, there's a pushback against another warrantless collection of data by local police departments. Techdirt reader zip sends in this Williamette Week story detailing the ID scanners police are actively pushing on bar and club owners, supposedly in an effort to cut down on underage drinking.

Multnomah County and Portland police this week suspended a new program that supplied data-gathering ID scanners to Old Town bars after WW raised questions about whether it was legal.

The state-funded program allowed Portland police to equip downtown bars and clubs in recent weeks with high-tech ID scanners that captured patrons’ names, ages and photos for upload to a central database, which police could then access.

The data collected is stored for 90 days and is compiled from the many scanners being utilized across the city. The scanners themselves are manufactured by Servall Data Systems out of Alberta, Canada. (Servall Data Systems also has access to the data.) Law enforcement agencies are given access to the collected data at any time requested (no subpoena or warrant needed) according to Servall's spokesperson.

A grant given to a local charity by the state of Oregon helped fund the purchase of these scanners, which were then pushed on local business owners by police departments. Unsurprisingly, some club owners balked at tracking their customers.

A few club owners turned down the free scanners. One owner says he added surveillance cameras when police asked. “I happily installed those. But this was going too far,” the club owner says. “It felt invasive.”

Not that every club owner feels the same. Some have purchased the scanners with their own funds, in part because it's another step they can take to protect their liquor licenses.

The company cites drops in crime in other cities in defense of the scanners. That the scanners have a deterrent quality and that they make crime investigation easier are hardly disputable. But the problem is the warrantless access to collected data, and more specifically in this case, the fact that this sort of data harvesting by businesses violates Oregon state law.

“It really is an illuminating example of where our privacy laws are, and our disconnect in a modern digital world,” says Becky Straus, lobbyist for ACLU Oregon.

Straus is referring to a 2009 Oregon law that limits companies’ legal ability to collect, store or share information from ID scanners. Straus says she was unaware Portland bars were collecting such data, or that police could grab it.

“We had wondered, when we wandered around Old Town, whether bars were complying with the swiping law,” she says.

That bar owners may have been unaware that their data collection violated state law isn't all that surprising. It's not really as much of a day-to-day part of their business as staying within the confines of their liquor licenses and complying with food safety laws. But, as Willamette Week discovered when it began investigating these scanners, many of those who should have been aware of this law had no idea they were actively encouraging business owners to break it.

Neither Portland police nor the city attorney was aware of the 2009 law until WW raised the question. “We‘re glad when someone brings this up. We want to do what’s best to protect public safety and protect people’s rights,” Multnomah County spokesman David Austin tells WW.

Austin said the county is meeting with state and local law enforcement in the coming week to determine how to move forward .

The spokesman for the Portland police department claims it's not the department's problem if these laws are violated.

He says the police don’t own the scanners, and so aren’t responsible for how they were used.

“It’s an issue between the bars and the company,” he says. “We recommend a lot of things to people, but it’s up to the individual to make sure it’s compliant.”

I'm not sure what part of that statement is more callously irresponsible, the fact that the PD will "recommend" actions and technology without ensuring it complies with applicable laws, or the fact that the PD recommends a data harvesting device but ultimately doesn't care how it gets used. The police have carte blanche access to the collected data, so its involvement bears the same weight as the supplier and the businesses utilizing the scanners. Considering it has this access, it would seem its responsibility to ensure compliance with applicable laws would be greater, especially since it's in the law enforcement business.

This also downplays the department's active promotion of the scanners, which led some business owners to feel the devices were mandatory, or at the very least, "strongly encouraged" by an entity holding the power to strip them of their liquor licenses. Here are some quotes from the story that show the department's involvement in pushing the devices its spokesman claims it's not responsible for.

“We tried to say ‘no’ at the very beginning, and police strongly encouraged that we should do it,” says Mike Reed, general manager of the Boiler Room and Jones Bar…

“If we don’t use it, they know,” a downtown bouncer tells WW…

Some Portland bar employees say the scanners keep police and the Oregon Liquor Control Commission happy...

As it stands right now, the county is going to "look into" the legality of the scanners. The police department seems to have washed its hands of the whole thing, claiming it's barely involved. The scanner company, which also has access to the data, seems to think there's nothing wrong with tracking people's nighttime activities and turning this data over to law enforcement any time they ask. And finally, we have business owners tracking their customers because it's been heavily implied that failing to do so may become a source of friction between the bar/nightclub and the police department.

Anyone could make the argument that what you do in public has no expectation of privacy. But this isn't in any way comparable to what police would have to do to achieve the same sort of surveillance level if the scanners weren't in use -- i.e. trailing hundreds of people around all night and noting which businesses they enter.

When technology turns the laborious into the routine, there needs to be checks in place to prevent abuse or, at the very least, provided some sort of friction between what the police can collect and what they can actually access. There also needs to be care taken to prevent collection of data simply because its possible, rather than being actually instrumental to crime prevention and investigation. But most importantly, those deploying these devices (by which I mean the police and the state that provided the grant to purchase the scanners) need to be aware of the laws governing their use, something no one quoted here seemed to know. (And, in the case of the police department, the person quoted not only didn't know, but didn't care, either.)

The state of Oregon has taken care to ensure data isn't collected or misused, but those looking for more data haven't bothered to perform due diligence before deploying devices that turn business owners into lawbreakers, and all in the name of the one of the most arbitrary of crimes, underage drinking.

Filed Under: fourth amendment, id scanner, oregon, police

NSA Surveillance Faces First Constitutional Challenge From Guy Arrested With Secret NSA Evidence

from the more-judicial-eyes-on-the-NSA dept

Here's comes another challenge to the constitutionality of the NSA's programs. The ACLU has joined defendant Jamshid Muhtorov in filing a motion that claims his Fourth Amendment rights were violated by the NSA's surveillance efforts and seeks to suppress the admission of that evidence.

"The FISA Amendments Act affords the government virtually unfettered access to the international phone calls and emails of U.S. citizens and residents. We’ve learned over the last few months that the NSA has implemented the law in the broadest possible way, and that the rules that supposedly protect the privacy of innocent people are weak and riddled with exceptions," said ACLU Deputy Legal Director Jameel Jaffer. "Surveillance conducted under this statute is unconstitutional, and the fruits of this surveillance must be suppressed."

Muhtorov is facing charges that he conspired to provide material assistance to an Uzbekistani resistance group. What makes his case unique is that, for the first time, the government is unable to withhold this source of evidence. This follows five years (since the FISA Amendments Act of 2008) of the Dept. of Justice successfully preventing defendants from discovering whether evidence was obtained via NSA surveillance.

At the outset of the prosecution, the government represented that it had conducted these searches based on “court authorization[s].” Aff. of Donald E. Hale, Special Agent, FBI ¶ 12 (attached to Crim. Compl., Doc. 1). On February 7, 2012, the government notified Mr. Muhtorov that it intended to “offer into evidence or otherwise use or disclose” in these proceedings information “information obtained and derived” from surveillance conducted under FISA, 50 U.S.C. §§ 1801–1811, 1821–1829. Doc. 12. That notice, however, made no mention of surveillance under the FAA.

Mr. Muhtorov did not learn that the government had intercepted his communications under the FAA until October 25, 2013, twenty months after the government’s initial FISA notice. This was because, until recently, the government had a policy of concealing from criminal defendants any connection between the FAA and their prosecutions. This policy violated both the FAA itself, 50 U.S.C. §§ 1881e(a), 1806(c), and the due process rights of criminal defendants like Mr. Muhtorov.

As the ACLU points out in its filing, none of this came to light until after the Supreme Court had decided Clapper v. Amnesty International. During that case, the government argued that Amnesty Intl and others didn't have standing to pursue the case because they couldn't show a "sufficient likelihood" that their communications were monitored. When questioned whether that assertion meant the government would be able to perpetually insulate the program from judicial review, the government deflected this by claiming it would notify defendants if evidence was obtained via bulk collection. But this wasn't true at that point or any time previous to that.

Though the Solicitor General did not know it at the time, his representation to the Court in Amnesty was untrue. In the five years between the FAA’s enactment and the Court’s consideration of Amnesty, no criminal defendant had received notice of FAA surveillance. In fact, the Justice Department had a practice of concealing from criminal defendants the role that the FAA had played in the government’s investigation of them. The Solicitor General apparently learned of the Justice Department’s policy only because the Chair of the Senate Select Committee on Intelligence, Senator Dianne Feinstein, made public statements about the government’s use of evidence acquired under the FAA in certain criminal prosecutions, including this one.

This refers to Feinstein's grandstanding in defense of the FAA back in October, where she presented a long list of cases supposedly aided by the programs authorized by the FAA. When she did this, she exposed the government's lie, in this case an inadvertent one by the Solicitor General, who honestly thought he was presenting the truth. Anyone on that list being prosecuted should have been informed of evidence obtained through these programs. Feinstein's defense of the NSA inadvertently publicized the government's concealment of evidence sources.

With standing now granted and the government forced to admit the evidence was acquired in this fashion, the ACLU hopes to have the evidence suppressed on constitutional grounds. While the program is now undergoing some changes in terms of access, the underlying collection is still constitutionally questionable. Hopefully, this provokes another examination of the NSA's untargeted, collect-it-all programs and moves the agency closer to adherence with the Fourth Amendment.

Filed Under: 4th amendment, constitutionality, criminal prosecution, fourth amendment, jamshid muhtorov, nsa, secrecy, surveillance
Companies: aclu

NJ Supreme Court Says Cops Need A Warrant To Obtain Cell Phone Location Data

from the another-small-victory dept

The New Jersey Supreme Court joins a handful of other courts in deciding that law enforcement agencies need a warrant in order to obtain cell phone tracking data.

The case itself goes back to 2006, dealing with three warrantless location requests placed by police to T-Mobile. These "traces" were used to track down a suspected burglar. Once on trial, the defendant moved to suppress, which the court agreed with, stating he had a reasonable expectation to privacy in terms of his cell phone data. However, the evidence was still allowed under an "emergency aid" exception. On appeal, the court allowed him to reopen his challenge of the suppression ruling but its decision aligned itself with many others, stating he did not have a reasonable expectation to privacy for information "in plain view." This specific challenge proceeded to the state Supreme Court, resulting in this ruling.

The ruling is somewhat state-specific. The court found that, historically, New Jersey's Constitution afforded greater protection against warrantless searches than the Fourth Amendment. (This relies on previous rulings by NJ courts, as the wording is nearly identical.)

This Court has found that Article I, Paragraph 7 of the New Jersey Constitution provides greater protection against unreasonable searches and seizures than the Fourth Amendment. When people make disclosures to phone companies and other providers to use their services, they are not promoting the release of personal information to others. Instead, they can reasonably expect that their personal information will remain private.

Splitting off further from the third party doctrine claim of reduced privacy expectations, the court offered this observation.

Viewed from the perspective of a reasonable expectation of privacy, what was problematic in 2006 is plainly invasive today. We are not able to draw a fine line across that spectrum and calculate a person’s legitimate expectation of privacy with mathematical certainty –- noting each slight forward advance in technology. Courts are not adept at that task. Instead, our focus belongs on the obvious: cell phones are not meant to serve as tracking devices to locate their owners wherever they may be. People buy cell phones to communicate with others, to use the Internet, and for a growing number of other reasons. But no one buys a cell phone to share detailed information about their whereabouts with the police. That was true in 2006 and is equally true today.

The court's argues that the more specific the data is, the greater the need for a warrant, and so-called metadata is surprisingly specific, especially when location data is included. Many investigative and intelligence agencies have gathered a lot of phone records by pushing the narrative that cell phone users are complicit parties in the creation of this data and therefore, willingly ceding their expectation of privacy. The New Jersey court's ruling is a strong rebuttal to that narrative.

This ruling will be effective moving forward and the court has decided not to apply the new standard retroactively. The new requirement goes into effect in 30 days, which may mean NJ telcos are in for a few last-minute fishing expeditions. The justices have kicked the case back to the appeals court and instructed it to apply the new ruling in determining whether its use of the "emergency aid" exception to allow the warrantless evidence was proper.

It may be a very venue-specific decision, but it's another small step towards restoring the expectation of privacy to cell phone users and their data.

Filed Under: fourth amendment, new jersey, privacy, third party doctrine, warrants