New York State Appellate Court Says Cell Site Location Records Have No Expectation Of Privacy

from the may-our-children-look-back-at-these-decisions-and-laugh-over-their-avocado-toast dept

The Supreme Court will deliver its ruling on the issue of cell site location info later this year, possibly changing the contours of the Third Party Doctrine for the first time since its erection out of thin air more than four decades ago. Until then, a patchwork of decisions has been handed down by state courts, some finding state law provides more protection for cell phone users than the US Constitution. At the federal level, however, years of precedent has resulted in a mostly-unified front by appellate courts. According to their decisions, cell site location info is a third-party record, undeserving of Fourth Amendment protections.

One of New York State's appellate courts has sided with the federal level. According to its recent decision, there are no privacy expectations in CSLI collected and stored by cell phone providers.

[W]e conclude that the acquisition of that information was not a search requiring a warrant under either the federal or state constitution. As the People point out, this case involves only historical cell site location information, contained in the business records of defendant's service provider, which placed his phone within a certain cell site "sector" at the time he used the phone to make calls, send text messages, or receive calls or messages.

Under these circumstances, we conclude that the acquisition of the cell site location information was not a search under the Fourth Amendment to the federal constitution because defendant's use of the phone constituted a voluntary disclosure of his general location to his service provider, and a person does not have a reasonable expectation of privacy in information voluntarily disclosed to third parties…

The court goes on to declare that even if it had felt like suppressing the evidence and extending privacy protections to CSLI, it wouldn't have helped the defendant.

As a final matter, we agree with the People that any error in the court's refusal to suppress defendant's cell site location information is harmless. The evidence of defendant's identity as a participant in the crime is overwhelming, and there is no reasonable possibility that the verdict would have been different if the location information had been suppressed…

This decision will stand even if the Supreme Court upends 40+ years of Third Party Doctrine rulings. Decisions like these are rarely retroactively applied. Even if Carpenter wins his Supreme Court case, it's likely the lower court will allow the evidence to remain in play, pointing out officers were reasonable to rely on precedential decisions finding no Fourth Amendment protections for third party records. The same goes for the defendant here. Post-decision alterations to the contours of the Constitution rarely help those whose rights have been determined to be violated after the fact.

Filed Under: 4th amendment, cell site location info, csli, expectation of privacy, location info, new york, privacy

Law Prof Argues Cell Location Records Shouldn't Need Warrants Because Cell Phones Have Encryption

from the towards-a-more-government-friendly-reading-of-the-4th-Amendment dept

As the Supreme Court readies itself for an important Fourth Amendment decision, the supporting briefs are beginning to trickle in. At stake is a potential redefining of the expectation of privacy under the Fourth Amendment, something that was diminished by the 1979 Supreme Court decision that created the so-called Third Party Doctrine.

In Carpenter's case, the third party records in question are something gathered by all cell phone companies: location data. The government used months of cell site location data to retrace Carpenter's movements, all without a warrant. This warrantless access turns cell phones into proxy tracking devices for the government. The government is perfectly fine with this turn of events and is asking the Supreme Court to uphold the lower court's decision.

A brief [PDF] siding with the government has been submitted by George Washington University law prof (and Volokh Conspirator) Orin Kerr. In it, Kerr makes some strange arguments.

The least weird argument is Kerr's assertion cell site location records shouldn't be covered by the Fourth Amendment because they are the equivalent of "observation in a public space." This is undoubtedly true, but it does allow the government to perform these "observations" without actually having to use its own eyeballs. Instead of tracking someone's movement through direct, in-person surveillance, the government can serve a subpoena to phone companies and use constantly-collected data to perform retrospective tracking.

Kerr goes on to serve up an analogy to buttress his assertion the Fourth Amendment should provide no protection for ostensibly "public" activities. And that's where the arguments start going off the rails.

[I]magine a world without communications networks. If Alice wants to communicate with Bob, Alice has to leave her home and travel to Bob’s house. If the police suspect that Alice and Bob are conspirators planning a crime, and they assign an officer to watch Alice’s whereabouts, the police can collect only some information without triggering the Fourth Amendment. The police cannot learn the contents of what Alice and Bob said inside Bob’s home without a warrant. On the other hand, the police can observe Alice and see what she did in public – when she left home, where she traveled, when she arrived at Bob’s house, and where they both live – without triggering the Fourth Amendment.

Next imagine that Alice calls Bob on her cell phone instead of meeting him in person. Alice no longer has to travel to meet Bob. The cell phone network delivers the call from Alice to Bob, making a remote transfer that eliminates the need for a public trip. But, critically, the same information exists. What was previously the contents of the conversation in Bob’s house is now the contents of the phone call between Alice and Bob. And what was previously Alice’s publicly observable trip from her house to Bob’s house is now a record that the phone provider generated and may keep about when the call was made, to and from what numbers, and what cell towers were used to deliver it.

What's glossed over in this analogy is the existence of landlines. This middle step is instructive and its absence from Kerr's brief seems almost disingenuous. For years, criminal collaborators used landlines and payphones to converse. This is what the Third Party Doctrine is predicated on: phone records. The Supreme Court's 1979 decision forced companies to comply with (and provide technical assistance for) pen register/trap-and-trace orders. These captured numbers dialed and length of conversations. The only location of interest was already known: the residence/phone booth containing the targeted phone. If law enforcement wanted information on suspects' movements, they still needed to deploy some form of additional surveillance.

Kerr is arguing law enforcement should have access to people's public movements without having to do the actual legwork. And he starts this argument by ignoring the fact law enforcement has -- for years! -- been unable to do anything more than collect phone records sans location data. But now phone records also contain information about people's movements, and Kerr believes they should be inseparable and easily-accessible. This assertion is made despite Kerr attempting to draw a straight line from the good old days of walking from house to house directly through CSLI and email header info.

To maintain the balance of the Fourth Amendment, courts should treat the same information in the same way in both the physical and network contexts. The contents of phone calls should be protected, as they are the telephone equivalent of protected inside space. This means, in the Internet context, that the contents of e-mails, text messages, and files that users place in cloud storage should receive full Fourth Amendment protection. On the other hand, non-content records generated by network providers – the business records they generate about how they delivered the communications – should not be protected because they are the network equivalent of the publicly observable trip that is outside such protection in the physical world.

Going on from there, Kerr says the court -- along with legislators -- must maintain an "equilibrium" between expectations of privacy and lawful access. But in this case, the equilibrium must shift towards the government. Why? Because criminals use cell phones.

The ways that cell phones can facilitate crime and avoid detection counsels against creating new Fourth Amendment protections for cell phone records. Obviously, most people don’t use their phones to commit crimes. But most people don’t have their records collected by court order under the Stored Communications Act, either. The key point is that the effect of cell phone technology on the “often competitive enterprise of ferreting out crime,” Johnson v. United States, 333 U.S. 10, 14 (1948), operates as a two-way street. The ability of cell phone companies to deliver communications quickly and silently over any distance cuts both ways. It can lead to records about the delivery that helps the police, and it can aid in the commission of crime that helps wrongdoers. Both should be considered.

He's right that both should be considered. But his argument doesn't suggest both should be considered. Kerr believes the government's view should be given priority -- a view that allows for no narrowing of the Third Party Doctrine. No one should be granted a higher expectation of privacy because criminals use cell phones. That's basically the argument. And it leads directly to this argument, which isn't any better. The Third Party Doctrine should remain intact because people -- including criminals -- use encryption.

It is too early to tell how far encryption will interfere with government investigative powers. But because users generally can’t encrypt non-content records such as historical cell-site records, the collection of such records may take on a more important role in future surveillance practices. The Court should be reluctant to introduce new constitutional protections for non-content records when the existing constitutional framework for access to contents may be impeded by new encryption technology.

I'm honestly unsure what to make of that argument, which seems to imply the Court should only view the Fourth Amendment as an avenue for law enforcement access, rather than its true purpose: protecting citizens from their government. Kerr talks about maintaining a balance, but posits that relevant technological advancements should work for the government, rather than against it. If people can have encryption and little metal-and-glass rectangles that allow them to hold private, long distance conversations, then the government should have uninterrupted, warrantless access to anything the government deems to be a "third party records."

This isn't the way to maintain balance. The Fourth Amendment isn't the government's enabler. And it never has been. It was written to curb government overreach and abuse. The government has been dealing with unobservable conversations for decades now. That it can now track people without ever leaving the office may be handy, but it doesn't necessarily follow it should always be able to do this without a warrant. The Supreme Court should take a close look at the implications of allowing the status quo to remain in place. Thousands of electronic devices generate millions of third party records every day, all less than a warrant away. Ignoring these implications in favor a simplistic rehashing of a forty-year-old decision is only going to cause further difficulties down the road.

Filed Under: 4th amendment, cell site location info, csli, encryption, location info, orin kerr, scotus, third party doctrine

ACLU Tells Court Long-Term Cell Site Location Tracking Should Require A Warrant

from the people-like-cellphones-much-more-than-they-like-their-government dept

The Supreme Court is going to take a look at the Fourth Amendment implications of warrantless access to historic cell site location information. The outlook for a Fourth Amendment win isn't particularly hopeful, given that there's no circuit split to be resolved. The lone holdout was the Fourth Circuit -- which originally had problems with the long-term collection of location information -- but that court reversed its earlier decision to align with other circuits which have addressed the issue.

That doesn't mean no one should try! Who knows what the court might decide, especially given the shifting telecommunications landscape. After all, it has managed to budge the 4th a wee bit now and then, even in decisions that were mostly punts or calls for the aggrieved to take it up with their Congressional reps.

The ACLU has filed a brief [PDF] on behalf of the appellants, pointing out what should be obvious: cell site location info isn't Just Another Third Party Record. It's a proxy tracking system for law enforcement, which can access this data without warrants. And it's only getting more precise every day.

Service providers have long retained location information for the start and end of incoming and outgoing calls. Today, those companies increasingly also retain location information related to the transmission of text messages and routine internet connections—which smartphones make virtually constantly to check for new emails, social media messages, weather updates, and other functions. The information recorded can include not only cell site and sector, but also estimated distance of the phone from the nearest cell site. Id. Location precision is also increasing as service providers deploy millions of “small cells,” “which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home.” United States v. Graham, 824 F.3d 421, 448 (4th Cir. 2016) (en banc) (Wynn, J., dissenting in part and concurring in the judgment) (citation omitted); see also Hoy, supra, at 69-70. All told, a typical smartphone connects to cell towers hundreds of times a day, generating a densely pixelated matrix of data points documenting the user’s movements. The volume and precision of that data will grow steadily in coming years, generating ever more granular locational information.

The ACLU notes Congress itself has granted consumer protections for CSLI, giving customers control over who has access to this data. Unfortunately, multiple courts have ruled that, since cell providers have access to the info and customers are at least somewhat aware their phones must connect to towers to provide service, this information can be obtained by the government with only a subpoena. (And, obviously, without the customer's consent.) In some rulings, this has been extended to real-time location tracking, with law enforcement officers basically shoulder-surfing telco computers for pings.

The brief draws a connection between virtual location tracking with CSLI and the Supreme Court's Jones decision, which dealt with long-term tracking of individuals with concealed GPS tracking devices. That decision didn't quite establish a warrant requirement, but did suggest warrantless long-term location tracking raised a number of Fourth Amendment issues.

Allowing law enforcement agencies to use service providers as tracking devices is a problem. It shouldn't really make a difference whether it's long-term or short-term, but the tremendous amount of location data automatically gathered can provide an extremely in-depth examination of someone's life, all through the magic of third-party records.

Worse, long-term tracking through CSLI exposes even more of a person's movements to the government. Phones go places cars don't. A suspect could "opt out" of GPS data collection by walking, using public transportation, or riding in vehicles without tracking devices. But people's phones go everywhere they go. Having this wealth of information on tap is a boon for law enforcement. Obtaining a warrant isn't some sort of insurmountable obstacle. The world has changed incredibly since 1979, which is when the Supreme Court created the Third Party Doctrine out of thin air. If nothing else, this case should give it the opportunity to take another look at a decision headed into its fourth decade and see if it still remains relevant in a world where almost every citizen carries around a proxy government tracking device wherever they go.

Filed Under: 4th amendment, csli, location info, supreme court, warrant
Companies: aclu

Supreme Court To Consider Fourth Amendment Implications Of Cell Site Location Info

from the finally...-but-will-it-be-a-decision-we-really-want? dept

We've been waiting a long time for the Supreme Court to tackle the Fourth Amendment implications of cell site location info. After putting it off for as long as possible (or so it seems...), the nation's top court is finally ready to handle yesterday's hotly-disputed tech/privacy issue.

The Supreme Court agreed Monday to hear a case next term challenging the use of cellphone records without a warrant.

The case, Carpenter v. United States, centers on Timothy Carpenter, who was convicted of committing a string of armed robberies of Radio Shack and T-Mobile stores in Michigan and Ohio between December 2010 and March 2011.

The government’s evidence at trial included business records from the defendants’ wireless carriers, showing his cellphone was used within a half-mile to two miles of several robberies during the times they occurred.

The nation's top court seemed to have a pretty good handle on the issues raised by today's smartphones in its Riley decision, so there's some hope the Court will engage in a thorough examination of the Third Party Doctrine in light of today's technological realities.

The Supreme Court turned down a chance to reconcile a circuit split back in 2015. Its decision to take it up now might make this a bit easier, seeing as that split no longer exists. The holdout -- the Fourth Circuit Appeals Court -- reversed its original finding to align it with the other circuits in stating there is no expectation of privacy in third party records.

The case the Supreme Court will examine comes from the Sixth Circuit Court and deals with historical cell site location records. Almost coincidentally, the Sixth Circuit Appeals Court released another cell site opinion the same day the Supreme Court announced its review, only this time dealing with real-time gathering of cellphone GPS data. In both cases, the Appeals Court found no Fourth Amendment implications, even though it had to push through its own contradictory assertions to arrive at this conclusion.

Unfortunately, a previous Supreme Court decision on GPS tracking further complicates the issue. The Court's decision on this issue -- which is very much related to warrantless access to cell site location info -- was about three-quarters punt. It suggested long-term warrantless GPS tracking could violate the Fourth Amendment, but did not go so far as to institute a warrant requirement. It's likely it could arrive at a similar non-decision here -- one that would allow the continued exploitation of the Third Party Doctrine by law enforcement, even though the wealth of data handed over to third parties by today's smartphones bears almost no resemblance to the dialing records discussed in 1979's Smith v. Maryland.

Filed Under: 4th amendment, carpenter v. us, cell site location info, csli, location info, scotus, supreme court, third party doctrine, timothy carpenter

Sixth Circuit Appeals Court Latest To Say Real-Time Cellphone Location Tracking Not A Fourth Amendment Issue

from the unfortunate-unanimity dept

The Sixth Circuit Appeals Court is the latest to weigh in on cell site location info. It joins every other circuit that has handled the issue in deciding the gathering of cellphone GPS data by law enforcement is not a search under the Fourth Amendment.

This decision [PDF] isn't too surprising considering the court reached the same conclusion last year in a similar case. The difference between the two is the latest case deals with real-time collection of GPS data, rather than historical GPS records. But that's the only difference. The Appeals Court believes the same holds true for real-time location info, although it cites something other than 1979's Smith v. Maryland in its analysis.

[T]he district court held—and we affirm, holding that the government’s detection of Montai Riley’s whereabouts in this case, which included tracking Riley’s real-time GPS location data for approximately seven hours preceding his arrest, did not amount to a Fourth Amendment search under our precedent in United States v. Skinner, 690 F.3d 772, 781 (6th Cir. 2012). The government used Riley’s GPS location data to learn that Riley was hiding out at the Airport Inn in Memphis, Tennessee—but only after inquiring of the front-desk clerk did the government ascertain Riley’s specific room number in order to arrest him. The GPS tracking thus provided no greater insight into Riley’s whereabouts than what Riley exposed to public view as he traveled “along public thoroughfares,” id. at 774, to the hotel lobby. Therefore, under Skinner, Riley has no reasonable expectation of privacy against such tracking, and the district court properly denied Riley’s motion to suppress evidence found upon Riley’s arrest.

While tracking a robbery suspect, law enforcement obtained an order demanding AT&T hand over location data as soon as it was collected.

The court order compelled disclosure of call metadata such as inbound and outbound phone numbers and cell-site location (CSL) data, as well as real-time tracking or “pinging” of the latitude and longitude coordinates of Riley’s phone. Specifically, the order required AT&T to disclose the following, potentially for two months, until August 26, 2015:

16. Precision location of mobile device (GPS Location) such that service provider shall initiate a signal to determine the location of the subject’s mobile device on the service provider’s network or with such other reference points as may be reasonable [sic] available and a [sic] such intervals and times as directed by State Task Force Investigators and Deputy Marshals of the United States Marshal Service.

The court goes on to note that the location records submitted as evidence do not show whether this collection of info was triggered by AT&T or by the cellphone's owner.

No evidence of record indicates whether Riley’s phone automatically transmitted its GPS coordinates to AT&T (and if so, whether on a continuous basis or otherwise) or whether AT&T affirmatively sent a signal to Riley’s phone to cause it to send AT&T its GPS coordinates.

This should have been a warning flag. It's one thing to collect this info as it comes in. If AT&T is pinging the phone to generate GPS coordinates, AT&T is essentially performing a search on behalf of the government. That should make a difference in this case, as it shifts it from being about a collection of third-party records to an affirmative gathering of records by the government, using AT&T as a third-party stand-in to work around warrant requirements. (Not that case law is settled for GPS tracking, but still…)

But it doesn't. The court goes on to say it doesn't matter because the records were gathered by a third party and they all dealt with the movement of an individual in a public area (the motel where he was arrested). That's why the court cites the Skinner decision, rather than relying exclusively on Smith v. Maryland.

In Skinner, we held that location data emitted by a “voluntarily procured” cell phone could not be subject to a reasonable expectation of privacy, even if the cell-phone user had no reason to expect that the government would compel the service provider to disclose those data. Id. at 779. There, because “the defendant’s movements could have been observed by any member of the public,” ibid., we held that it could not possibly be a Fourth Amendment violation for law-enforcement officers to monitor those movements by using cell-phone location data just because such electronic monitoring was more efficient than relying on visual surveillance alone.

But it then goes on to reach a conclusion which seems to contradict the evidence provided.

Using seven hours of GPS location data to determine an individual’s location (or a cell phone’s location), so long as the tracking does not reveal movements within the home (or hotel room), does not cross the sacred threshold of the home, and thus cannot amount to a Fourth Amendment search. After all, the tracking in Knotts revealed the location of the cabin to which the criminal suspects had traveled—but the tracking in Knotts was not a search because it revealed no information about the interior of the cabin itself. Likewise here, the tracking revealed only that Riley had traveled to the Airport Inn, not which room (if any) the phone was in at the time of the tracking.

The lack of location info particularity should have worked against the government's argument. The court even admits in a footnote the government had no idea where exactly the suspect was located -- only a general idea that he was likely in a publicly-accessible building.

When viewed on a map, the majority of these coordinates are scattered within the perimeter of the Airport Inn, but with insufficient precision—even if the Airport Inn were only one story tall—to reveal which room, if any, the phone was in at the time of each ping.

So, it could be argued the government did track the suspect's "movements within… a hotel room," which would put this back in Fourth Amendment territory. But the court never attempts to reconcile these contradictory statements and instead continues to use both the motel's accessibility and the coarse location info as an argument against potential Fourth Amendment violations.

That Riley was arrested in a motel is of no moment, for the government learned no more about Riley’s whereabouts from tracking his cell-phone GPS data than what Riley exposed to public view by traveling to the motel lobby “along public thoroughfares,” Skinner, 690 F.3d at 774—even if Riley meant to keep his location a secret, one cannot expect privacy in one’s public movements.

Certainly the arrest was "no moment," but the tracking that occurred once he was inside the building should have been given more consideration. The fact that law enforcement can obtain real-time location tracking information definitely needs to be examined more closely, especially when there's ample evidence law enforcement has effectively backdated orders like these to cover up use of more intrusive technology like Stingray devices.

Filed Under: 4th amendment, 6th circuit, csli, location info, third party doctrine

After Appeals Court Flip-Flop, Aaron Graham Asks Supreme Court To Examine Warrantless Access To Cell Location Info

from the one-more-time dept

Aaron Graham -- the defendant at the center of a Fourth Amendment dispute over the warrantless acquisition of cell site location info -- is hoping to get one more court to take a look at his case.

Last summer, the 4th Circuit Court of Appeals became the first appeals court to institute a warrant requirement for historical CSLI. As was noted then, the court found that the records generated by cell phones (and held by phone companies) had an expectation of privacy -- at least when obtained for a significant period of time. In Graham's case, the government obtained 221 days of historical cell site location data -- the sort of extended period the Appeals Court found troubling… originally.

The government appealed and attempted to differentiate its long-term, post-facto tracking of Graham's movements with eight months of CSLI from the Supreme Court's Jones decision -- which (sort of) found that deploying a surreptitious GPS tracker required the use of a warrant. It claimed this form of location tracking was completely different than the other form of location tracking, mainly because in Graham's case the tracking was done by the phone company. The government simply benefitted from the warrantless collection of records the phone company was already compiling.

The court bought the government's arguments the second time around. The short-lived warrant requirement was removed and the 1979 definition of the Third Party Doctrine (Smith v. Maryland) was reinstated. The dissent correctly pointed out that no cell phone user voluntarily turns over location data to service providers. It's just something that has to happen for phones to make calls or access data. It also pointed out that, unlike other third-party records, customers aren't allowed to access their own cell site location data. Only the phone company and the government can do that, even though it's the customer generating the records and paying for their collection and storage.

Graham is now petitioning [PDF] the Supreme Court to review the case. (h/t Gitmo Watch) If it does, things could get interesting. Unfortunately, there's no telling which version of "interesting" we'll get.

As it stands now, there's no cohesive stance on CSLI in the nation's courts. If there are precedential findings, most side with the government's Third Party Doctrine theory. A few lower courts have recognized an expectation of privacy in these auto-generated records, but at the Appeals Court level, nothing else has come down in favor of this finding. There are some open pending appeals, but no rulings have been handed down yet.

The cert petition notes that courts should not be so quick to extend a benefit of a doubt to law enforcement agencies who do everything they can to avoid filling out a search warrant application.

Leon explains that police officers who obtain a warrant that appears to satisfy the probable cause requirement can “literally” do “nothing more . . . in seeking to comply with the law.” Id. at 921 (internal quotation omitted). Suppressing evidence after a police officer conducts a search with a warrant in hand will not serve the exclusionary rule’s deterrent effect because suppression would not “alter the behavior of individual law enforcement officers or the policies of their departments.” Id. at 918.

The Fourth Circuit’s contrary conclusion misapplies Leon to the point of creating a direct conflict with this Court’s precedent. Here, in contrast, law enforcement easily could, but chose not to, follow the constitutionally secure path. They could have followed 18 U.S.C. § 2703(c)’s explicit warrant requirement, which clearly satisfies the Fourth Amendment, instead of taking their chances with the non-warrant procedure of § 2703(d). Unlike Leon, the prosecutor who sought and used the § 2703(d) order knew that the order was neither a warrant nor the equivalent of a warrant, and knew that the constitutionality of his choice was already in doubt.

Graham argues the evidence obtained should be suppressed, rather than put back into service on the back of the good faith exception and a multitude of conflicting court decisions. A deterrent only works if you actually apply it.

Indeed, suppressing the evidence here would alter the behavior of both individual officers and policies of departments and thus would serve the deterrent purposes of the exclusionary rule. Prosecutors and police departments would be put on notice that they should not always be looking for loopholes to the warrant requirement. They would know that in the future, documents that do not satisfy the Fourth Amendment’s warrant requirement more likely than not will not justify the search of a citizen’s person, papers, and effects.

Whether or not the Supreme Court will take also remains to be seen. The court has been rather schizophrenic on its Fourth Amendment decisions in recent years and it may not be in any hurry to handle something with this many future implications while it's still short a justice.

Filed Under: 4th amendment, aaron graham, csli, location info, scotus, supreme court

Federal Judge Says Real-Time Cell Location Info -- Whether Obtained With A Stingray Or Not -- Requires The Use Of A Warrant

from the no-more-pen-register-orders dept

An interesting decision by a federal judge in Florida suggests this district, at least, may not be amenable to the warrantless use of Stingray devices… or any other method that harvests cell site location data in real time.

Although the defendants lost their motions to suppress due to a lack of standing, the judge had this to say about the acquisition of cell site location info in this case. (via FourthAmendment.com)

Here, I agree with the Defendants that law enforcement's seizure of precise realtime location information by surreptitiously monitoring signals from the cell phones in this manner is a search subject to the proscriptions of the Fourth Amendment. Such is the express conclusion of the Florida Supreme Court and the conclusion suggested by the Supreme Court. See Tracey v. Florida, 152 So.3d 504 (Fla. 2014); United States v. Jones, 132 S.Ct. 945 (2012). As such, law enforcement should have obtained a search warrant issued upon probable cause. The Government concedes that the practice in this Court requires a warrant based upon probable cause for such searches and that the these pen/trap applications did not establish probable cause.

Originally, the defense claimed police used a Stingray to track five burner phones used by the defendants. This seemed to be the most logical conclusion, considering how closely and immediately the location data was acquired. But the government responded that no cell site simulators were used to track the devices. Instead, another tool that has long been available to law enforcement was deployed -- a tool created explicitly for law enforcement use by the cell provider.

On July 21, 2016, the Court heard argument of counsel and took testimony from Detective Joseph Petta, the co-affiant on each of the applications at issue. In short, Detective Petta testified that law enforcement obtained pen/trap authorizations for the cell phone numbers at issue in order to obtain precise realtime location information that was used to track the whereabouts of these phones, to identify those associated with Defendants, and to identify locations of interests. He denies use of a Stingray or similar device, but acknowledges that he used a website offered to law enforcement by Sprint (the "L-site") to obtain such information. Such realtime information was available every fifteen minutes twenty-four hours a day. He further acknowledges that law enforcement used the realtime information to track the cellular phones, which they believed were used by this group. By his account, such applications were the usual way to obtain such realtime location information at the time these applications were submitted.

[...]

According to Detective Petta, the website allows law enforcement to log on and obtain realtime or contemporaneous and highly precise longitudinal and latitudinal information linked to GoogleMaps. A spreadsheet of all such location data is made available to law enforcement. Detective Petta testified that the pen/trap orders were not used for any other purpose than to obtain the realtime location of the cell phones.

The information returned from L-site queries is likely not as timely or precise as a roving Stingray but can achieve the same objectives. (An example of L-site data can be seen here.) Sprint has made this tool available for law enforcement to use since at least 2009, tracking roughly with the rise in Stingray use by police departments. The difference here is any law enforcement agency can obtain this data, which opens the market to those who don't have these devices yet or a warrant requirement they'd rather work around. Obviously, this also aids those deploying parallel construction to keep Stingray use hidden.

Either way, the court doesn't agree with the government's assertion that a pen register order is sufficient for obtaining real-time cell site location info. The order cites the Supreme Court's US v. Jones decision in support of its determination that real-time location tracking is a search and requires the use of a warrant -- something the original decision failed to state quite as explicitly. (It only found that placing a GPS device on a vehicle is a search under the Fourth Amendment. The issue of real-time location tracking remained mostly unaddressed.)

But while this order may alter law enforcement's tactics (and even the government admits it should have acquired a warrant in light of other Florida district decisions), it does nothing for the two defendants. An expectation of privacy in real-time location data doesn't help two defendants with a handful of burner phones they're reluctant to claim as their own. The absence of any link between the tracked phones and the defendants means they have no standing to challenge the search.

Defendants here have asserted no claim to or interest in the cell phones at issue. The cell phones were not registered in Defendants' names, and Defendants presented no evidence regarding their possession, use, or control of the phones. Instead, Defendants rely solely upon loose allegations in the pen/trap applications submitted by the Government, which suggested a link between the cell phones and Defendants in conclusory, unsupported fashion. In the circumstances and in the absence of contrary case law, I am obliged to conclude that they fail to establish standing to contest the searches at issue and the motions to suppress should be denied.

A lack of standing tends to be fatal to motions to suppress. But the disavowal of ownership does shift the burden of proof back on the government, which makes it a little harder to prove the burner phones actually belonged to the defendants found carrying them. The court notes the "loose allegations" contained in the pen register applications are "conclusory" and "unsupported," which seems to indicate the government has a few more hurdles to overcome before it can tie the defendants to the phones they're not willing to claim.

Filed Under: 4th amendment, csli, imsi catcher, location info, stingray, warrants

Connecticut Judge Says Cops Can't Get Real Time Cell Site Location Info Without A Warrant

from the which-apparently-law-enforcement-already-knew dept

It's a lower-level decision but it still means something. Well, a couple of somethings. First off, it appears Connecticut law enforcement probably shouldn't continue seeking "live" cell site location information without a warrant. It also appears the law enforcement agency involved doesn't have access to a cell site simulator (Stingray, etc.).

New Haven Superior Judge Jon Blue agreed to suppress evidence in an ATM robbery case, saying it was the result of Connecticut State Police improperly asking in advance to receive periodic live updates from the phone company of the location of the suspect’s cellphone

The Monday ruling comes in the case of Terrance Brown, 29, of Stratford, who was charged with robbing several automated bank teller machines in 2010.

T-Mobile was ordered to provide the location of Brown’s cellphone every 10 minutes during the time police were tracking him.

This sort of collection is nothing new. Many law enforcement agencies act under the belief that location information is just another business record, subject to fewer restrictions and a lower level of privacy protections. Generally speaking, courts have found the acquisition of historical cell site location data without a warrant to have minimal impact on Fourth Amendment protections. Using this information as a tracking device, however, has generated plenty of friction in the judicial system, something that probably won't be resolved until the Supreme Court tackles it.

In this case, the presiding judge found that the omnipresence of cellphones wasn't supposed to be viewed by law enforcement as a bold new world of exploitable tracking devices.

“The convenience of cellphones is well known; it is increasingly rare to meet someone who doesn’t carry one on his or her person,” Blue wrote. “But with this convenience comes the possibility of an Orwellian state.”

Currently, the state's laws only demand law enforcement offer "reasonable, articulable suspicion" in exchange for phone records, including location info. (This is the same standard the NSA is "held" to in its acquisition of phone records.) The ACLU would like to see that raised to "probable cause," but it's going to be an uphill battle against reams of legal precedent. Circuit splits on the issue of whether location data should be considered a business record complicate the matter, but for the most part, jurisprudence suggests location data -- especially historical location data -- may act as an ad hoc tracking device but still somehow lands outside of the Fourth Amendment's protections.

But using a phone as a GPS stand-in isn't quite the same thing, not when law enforcement is issuing subpoenas demanding periodic updates on futurelocation pings. Judge Blue notes the case's prosecutors admitted state law does not permit the warrantless tracking of individuals via their cellphone providers. Not that this admission means much when weighed against law enforcement's actual actions.

Using a 2005 "update" to a telecommunications record statute (referred to by some as Connecticut's Patriot Act), law enforcement could secure "ex-parte" orders to obtain phone records and communications. All that's required is reasonable suspicion. And use these orders law enforcement did -- more than 14,000 times since the law was enacted. An attempt to restore the warrant requirement died this summer in the state's legislature. Perhaps the judge's decision here will prompt legislators to take another run at restoring some Fourth Amendment protections to cell phone records.

However, the lack of a prosecutorial challenge suggests law enforcement knows the law doesn't specifically grant it the power to perform real-time tracking of individuals without warrants. Then again, knowing this didn't stop it from doing it, and the end result is the loss of its collected evidence, and most likely the case itself.

Filed Under: 4th amendment, cell site location info, connecticut, csli, jon blue, location info, warrant

Defendants Counter Government's Arguments That Appeals Court Should Treat Cellphones As 'Personal Homing Beacons'

from the government-still-thinks-it's-1979 dept

A couple of weeks ago, the government petitioned the Fourth Circuit Court of Appeals for an en banc rehearing of its decision finding that the acquisition of historical cell site location information (CSLI) requires a warrant. The government used many of the arguments the dissenting opinions did -- mainly that CSLI should still be considered a "business record" under the Third Party Doctrine.

It argued that while the court had held that cellphone users do not voluntarily convey location data when they use their phones, they also do not affirmatively agree to provide service providers with time, date, number called and length of the phone. These are all just parts of how service providers do business. With this argument, the government hopes to equate the tracking technology of modern cellphones with the simple phone records created by landlines -- the latter of which can be obtained without a warrant.

Obviously, the two types of data are nothing alike. Landlines don't generate location information because they're in a fixed position. Cellphones -- on top of creating location records whenever a call is placed -- also create continuous location data as they hop towers to obtain signals, even while the phone is not in active use.

The defendants in the original case have filed their opposition to the government's request for a rehearing, arguing (naturally) that the court came to the correct decision the first time around.

The panel correctly decided that tracking a person using historical cell site location information (CSLI) for 221 days, without a warrant or probable cause, is dragnet surveillance that the Fourth Amendment prohibits. See United States v. Jones, 132 S. Ct. 945, 952 n.6 (2012). The government is essentially asking this Court to treat cell phones as personal homing beacons, providing it the wherewithal to follow and recreate a person’s every movement. The government seeks to do so without a warrant or probable cause, using the excuse that telecommunications providers also happen to know when and where an individual has gone and is going.

The difference between what the government did here and what George Orwell envisioned is that Big Brother’s constant surveillance through telescreens was stationary. But the surveillance here moves with citizens using a common household device carried in the pockets or purses of almost every American adult. Our Founders crafted the Fourth Amendment to require a warrant based on probable cause before the government could acquire such intimate information about a person. The panel’s conclusion that the government must comply with the warrant requirement before obtaining historical CSLI correctly applies the Fourth Amendment.

More to the point, the filing argues that the government's purported reason for the rehearing request is flawed in and of itself. The government noted the circuits are split in their opinions of CSLI's Fourth Amendment implications. The government says a rehearing will "resolve" the current circuit split. The defendants point out that a rehearing will do nothing of the sort, no matter how the court resolves its own differences from its first (divided) opinion. That's up to the nation's highest court to settle, should such a petition be granted.

While it is true that the majority opinion conflicts with decisions from the Fifth and Eleventh Circuits regarding the applicability of Smith and Miller and the third party doctrine, these courts had already split with the Third Circuit. The Eleventh and Fifth Circuits held that individuals have no reasonable expectation of privacy in historical CSLI because, under Smith and Miller, individuals voluntarily disclose their location data to cellular service providers…

These splits existed before the panel’s decision. The panel thoroughly addressed all the different positions in its 134-page opinion. If any further review of this issue should occur, it should be in the Supreme Court, the only forum that can clarify the fractured state of the law. A petition for certiorari is already pending in Davis, which, if granted, would resolve these splits.

The opposition filing also notes that while the government cites several court decisions in support of its Third Party Doctrine-based arguments, it relies on nothing more current than 1979's Smith vs. Maryland -- the decision that upheld the warrantless acquisition of call routing data via pen register orders. In doing so, it bypasses the most recent Supreme Court decisions on cellphones and warrants: Riley and Jones.

Riley v. California establishes that individuals have a privacy interest in historical CSLI. 134 S. Ct. 2473, 2490 (2014). Historical CSLI generated by cell phones served as one of the Court’s chief examples of “the privacies of life” included in cell phone metadata. The Court described just how intimate and detailed location data is: “Data on a cell phone can also reveal where a person has been. Historic location information . . . can reconstruct someone’s specific movements down to the minute, not only around town, but within a particular building.” Id. The Court explained the intrusive nature of CSLI tracking by adopting Justice Sotomayor’s concurrence in United States v. Jones, 132 S. Ct. 945, 955 (2012). The unanimous Riley Court thus concluded that monitoring “a precise, comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations” infringes upon an individual’s reasonable expectation of a privacy that is protected by the Fourth Amendment.

These findings are echoed in the appeals court's decision, but the US government wants those conclusions rolled back. A patchwork of conflicting opinions on CSLI and the Fourth Amendment won't be resolved until the Supreme Court addresses the issue directly, but until then the government apparently would like to keep its warrantless options open.

Filed Under: 4th amendment, cell site location info, csli, doj, location info, mobile phones, warrants

Important California Privacy Bill Signed Into Law: Police Need A Warrant To Look At Your Data

from the now-for-federal-reform dept

For a long time now, we've been talking about the need for ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is a truly outdated piece of law that law enforcement regularly abuse to conduct warrantless searches on your digital information. There are a number of problems with it, but the most cited one is the fact that it considers emails to be "abandoned" if they've been on a server for 180 days, and thus no warrant is needed to read those emails. That may have made sense in the mid-1980s when the law passed and the few people who used email downloaded their emails from a server to a local disk, but it makes no sense at all in the cloud era. However, actually getting ECPA reform through Congress has proven difficult, in large part because some in law enforcement really like this ability to snoop on your emails.

Thankfully, here in California, Governor Jerry Brown has just signed a new bill, for CalECPA, which protects users' digital information here in California. Just like the federal ECPA should do, CalECPA requires a warrant for access to digital records, including emails and text messages -- and the same goes for geographical location information.

This is a big win for EFF and the ACLU, who have been pushing for this law to make it through the California Assembly and then have Governor Brown sign it. Now, if only we could do something similar at the federal level...

Filed Under: calecpa, california, ecpa, ecpa reform, email, jerry brown, location info, privacy, text, warrant