Government Asks Appeals Court To Change Its Mind On Warrant Requirement For Cell Site Location Info

from the OP-PLS-RESPOND dept

The Fourth Circuit Court of Appeals might be revisiting its recent decision of imposing a warrant requirement on the acquisition of cell site location information. The government has asked for an en banc hearing to settle this issue.

As of now, there is no unified view on the privacy (or lack thereof) inherent to historical cell site information. Nathan Freed Wessler, staff attorney for the ACLU, has put together a map of current decisions that shows where warrant requirements have been established (for now -- many are being appealed/challenged) and where they haven't. (Click through for a [slightly] larger version.)

Back in August, the Appeals Court pointed out that cell phone users don't voluntarily give up their expectation of privacy by "providing" certain information to "third parties" (cell phone providers). It's actually the reverse. The phone companies collect this information. And while phone users may agree to allow cell providers to collect this (and they have no choice -- without it, no cell provider would connect a call), they do not explicitly give the government permission to collect this information as well. And most people don't even cognitively agree to hand it over to cell phone companies.

... First, the policy only states that Sprint/Nextel collects information about the phone’s location – not that it discloses this information to the government or anyone else.

Second, studies have shown that users of electronic communications services often do not read or understand their providers’ privacy policies. There is no evidence that Appellants here read or understood the Sprint/Nextel policy.

The government has leveraged the ignorance of the public just as often as service providers have. No one reads Privacy Policies and no one truly expects the government to have warrantless access to location information gathered by the providers. But the government has often successfully claimed it can obtain this information without a warrant, thanks to the Third Party Doctrine, which legally erases any expectation of privacy.

So, as the courts tiptoe towards a more unified view of the Fourth Amendment as it pertains to cell site location information, the government is fighting a multi-front battle to protect its warrantless access to a wealth of ostensibly personal information.

Hopefully, this battle will be uphill. In the request for the en banc hearing, the government notes the court's unwillingness to apply the Third Party Doctrine to this information.

The majority flatly rejected application of the third-party doctrine. Op. 36-60. The majority sought to distinguish Miller and Smith on the ground that “the defendant in those cases had ‘voluntarily conveyed’ the information to the third party.” Op. 39; see Op. 42-43. The majority concluded that historical CSLI is not “voluntarily conveyed” because a “user is not required to actively submit any location-identifying information when making a call or sending a message.” Op. 44. Disregarding the undisputed evidence that cell phones cannot work unless the service provider knows which cell tower to use, and that Sprint/Nextel informed customers that it collected their location information, the majority deemed it “clear” that “cell phone users do not voluntarily convey their CSLI to their service providers.”

On the other hand, it points to dissenting opinions that note adding a requirement that users must "actively submit" information to third parties to consider it obtainable without warrants is at odds with several precedential decisions.

As Judge Motz observed, the majority’s insistence that an individual only “voluntarily conveys” what he “actively submits” contravenes long-established business records jurisprudence. See Op. 119-20. Customers do not “actively submit” the date, time, and duration of phone calls, but neither this Court nor any other court has held that such information is protected by the Fourth Amendment. The majority’s reasoning could have far-reaching consequences. For example, Internet communications are routed via IP address, and courts have held that users lack a reasonable expectation of privacy in IP address information, see, e.g., United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008)—but users do not actively submit IP addresses to their service providers. The majority’s creation of a Fourth Amendment interest in such data vitiates the third-party doctrine and eliminates the bright line (or any discernable line at all) between information protected by the Fourth Amendment and information that belongs to a third-party.

However, considering the wealth of information routinely gathered as "business records" via personal cell phones, it's perhaps time to start setting new precedents. While pen register orders can be used to obtain call data from landlines, these records provide no location information. The phone is locked to a single residence or business. (The same can be said for most IP addresses.) Today's pocket narcs create records continuously, generating a persistent record of a person's movements. And this location information is often generated without a single phone call being made -- further distancing cell site location from old-fashioned call data.

The government also argues that the Supreme Court's Jones decision -- which dealt with the warrantless use of GPS tracking devices -- shouldn't be applied here, as historical cell site location data isn't really the same thing. (It overstates the significance of the decision, which was about three-quarters "punt.") Technically, it isn't, but for the sake of the Fourth Amendment, it conceivably should be. While a tracking device may provide real-time location data, the location data obtained from cell phone providers offers the same sort of tracking, if only slightly delayed and with a little less accuracy.

No hearing has been granted yet, but government petitions tend to receive a bit more deference from the courts. When it does rehear this, the government will once again be arguing against the establishment of a warrant requirement -- a permission slip that is often treated as a rubber-stampable formality by magistrate judges and just as routinely treated as an onerous burden by law enforcement agencies.

Filed Under: 4th amendment, cell site location info, csli, doj, fourth circuit

Court: Cell Site Location Records From Five Minutes Ago Are 'Historical,' Not 'Real Time'

from the rewriting-history-multiple-times-per-hour dept

The word "historical" tends to conjure up images of musty buildings with plaques attached to them denoting the original construction and possibly who did what when, but several dozen years ago. While anything that happened just before right now could literally be termed "historical," most people tend to associate the word with things that happened well before the exact present.

Not so much the courts, though. "Historical" data involves anything not collected in "real time," apparently. The North Carolina Court of Appeals has ruled that something occuring at nearly any time before right now is "historical," even if the "history" itself traces back less than ten minutes.

Superior Court Judge Lucy N. Inman signed the order and Detective Mitchell submitted it to AT&T, the cellular phone service provider and holder of the account associated with the phone number. AT&T provided the records of the location of the cell phone tower “hits” or “pings” whenever a call was made to or from the cell phone. AT&T sent emails of the longitude and latitude coordinates of these historical cell tower “hits” to Detective Mitchell every fifteen minutes. Detective Mitchell testified an approximately five- to seven-minute delay occurred between the time the phone “pinged” a cell phone tower and the time AT&T received and calculated the location and sent the latitude and longitude coordinates to him.

This location info helped track the defendant to a motel and he was arrested shortly thereafter. The defendant sought to suppress the warrantless "search" of his cell phone and its location (obtained via a phone records production order that ran from a month before it was requested to two days after the request was granted [December 10, 2012]). The location data that traced the defendant back to the motel room was acquired (with a 5-7 minute delay) on December 11.

The defendant argued that the "real time" tracking of his location violated his Fourth and Fourteenth Amendment rights (as well as analogous parts of North Carolina's constitution). The court doesn't buy these arguments, citing the Stored Communications Act, which allows government entities to obtain certain third party records without a warrant. It says the difference between what's been considered unconstitutional by several courts -- obtaining real-time location information with a tracking device -- isn't what's happening here.

It argues that because the police didn't intercept these "records," everything is above-board, even if the sought "historical" data included two days of "records" that were created after the court order was approved.

Several courts have held the SCA permits a government entity to obtain cell tower site location information from a third-party service provider in situations where the cell tower site location information sought pre-dates the court order and where the cell tower site location information is collected after the date the court order issues. Although the former may technically be considered “historical” while the latter is “prospective” in relation to the date of the court order, both are considered “records” under the SCA. The government entity only receives this information after it has been collected and stored by the third-party service provider.

In plainer English, this means law enforcement entities can seek "historical" records from the "future," with the mitigating factor being that the records are collected by third parties first. A short delay of a few minutes is enough to call these records "historical" under this interpretation.

In a slightly-dissenting concurrence, Judge C.J. McGee diagrees with the court's definition of "historical" records (while finding the overall opinion valid because of the good faith exception).

Because most federal courts recognize that historical cell site information consists of information generated prior to the issuance date of a judicial order that allowed law enforcement to obtain such records for a given defendant, and because I believe allowing the majority’s characterization of the information provided by AT&T to law enforcement, based on the facts in this case, would effectively obliterate the distinction between “historical” and “real-time” cell site information, I must respectfully disagree with the majority’s characterization.

McGee points to a few details that make this "historical" location data far more analogous to real-time tracking: the fact that the court order allowed for the acquisition of cell site location records for two days past the point of issuance, that the police and AT&T remained in constant contact during the tracking of the suspect and the same short delay ("5-7 minutes") that the majority declared made the records "historical."

While the majority's interpretation dilutes the meaning of "historical" by including location data yet to be generated under its warrantless wing, it does point out to possible future problems with the use of Stingray devices. These have often been deployed with the same sort of court orders, but contain the ability to track individual phones in real time. Once more details on these deployments come to light, the courts will be forced to confront a plethora of Fourth Amendment violations -- at least if they're going to remain consistent with this interpretation of "historical."

Filed Under: 4th amendment, cell site location info, csli, ecpa, law enforcement, north carolina, sca, stored communications act
Companies: at&t

Summer Of The 4th Amendment: Appeals Court Says Mobile Phone Location Is Protected Under 4th Amendment

from the secure-in-their-persons,-houses,-papers,-and-effects dept

It appears that the 4th Amendment is up for a bit of a revival this summer. Last week, we wrote about an important ruling in a Northern California district court saying that mobile phone location info -- officially known as "Cell Site Location Info" or "CSLI" -- was protected by the 4th Amendment, meaning the government couldn't scoop it up without a warrant. The ruling was excellent and detailed, but we noted there would be inevitable appeals.

Now, in a similar case that had already been decided the other way, the 4th Circuit appeals court has overturned that ruling and agreed that mobile phone location info requires a warrant. This is another big victory for the 4th Amendment.

Appellants Aaron Graham and Eric Jordan appeal their convictions for several offenses arising from a series of armed robberies. Specifically, Appellants challenge the district court’s admission of testimonial and documentary evidence relating to cell site location information (“CSLI”) recorded by their cell phone service provider. We conclude that the government’s warrantless procurement of the CSLI was an unreasonable search in violation of Appellants’ Fourth Amendment rights.

Unfortunately, the court says that it doesn't matter in this case because of the "good faith" exception. We've discussed in the past the problems of the "good faith exception," which basically says it's okay to violate the 4th Amendment so long as law enforcement doesn't know it's violating the 4th Amendment. From a basic rights perspective, that seems ridiculous. But, at the very least, this ruling still should make it clear that going forward a warrant is necessary.

The appeals court ruling goes pretty much along the lines you'd expect, pointing out that there's an expectation of privacy in the CSLI and therefore a warrant is needed. It rejects the government's assertion that Sprint/Nextel's privacy policy was agreed to by the defendants and thus waived any privacy expectation.

As an initial matter, we are not persuaded that, as the district court stated, Sprint/Nextel’s privacy policy disproves Appellants’ claim that they had an actual expectation in the privacy of their location and movements. The privacy policy in effect at the time Sprint/Nextel disclosed CSLI to the government stated as follows:

Information we collect when we provide you with Services includes when your wireless device is turned on, how your device is functioning, device signal strength, where it is located, what device you are using, what you have purchased with your device, how you are using it, and what sites you visit.

... First, the policy only states that Sprint/Nextel collects information about the phone’s location – not that it discloses this information to the government or anyone else.

Second, studies have shown that users of electronic communications services often do not read or understand their providers’ privacy policies.3 There is no evidence that Appellants here read or understood the Sprint/Nextel policy.

The court relies on a series of relatively recent Supreme Court decisions to make it clear that the 4th Amendment applies in this case:

Taken together, Karo, Kyllo, and the views expressed in Riley and the Jones concurrences support our conclusion that the government invades a reasonable expectation of privacy when it relies upon technology not in general use to discover the movements of an individual over an extended period of time. Cell phone tracking through inspection of CSLI is one such technology. It is possible that the CSLI for a particular cell phone is not very revealing at all because, for instance, the phone has been turned off or it has made few or no connections to the cellular network. But the government cannot know in advance of obtaining this information how revealing it will be or whether it will detail the cell phone user’s movements in private spaces.... We hold, therefore, that the government engages in a Fourth Amendment search when it seeks to examine historical CSLI pertaining to an extended time period like 14 or 221 days.

It's a good ruling and it looks like the courts are building up a series of rulings on this issue that will inevitably reach the Supreme Court in the near future...

Filed Under: 4th amendment, 4th circuit, csli, expectation of privacy, location info, mobile phones

4th Amendment Lives: Court Tells US Government Get A Warrant If It Wants Mobile Phone Location Info

from the look-at-that dept

A potentially big ruling came out of the courtroom of Judge Lucy Koh yesterday, in which she affirmed a magistrate judge's decision to tell the government to get a warrant if it wants to obtain historical location info about certain "target" mobile phones (officially known as "Cell Site Location Info" -- or CSLI). The government sought to use a provision of the Stored Communications Act (a part of ECPA, the Electronic Communications Privacy Act) to demand this info without a warrant -- using a much lower standard: "specific and articulable facts" rather than the all important "probable cause." Judge Koh says that's doesn't pass 4th Amendment muster, relying heavily on the important Supreme Court rulings in the Jones case, involving attaching a GPS device to a car, and the Riley case about searching mobile phones.

Based on the preceding U.S. Supreme Court cases, the following principles are manifest: (1) an individual’s expectation of privacy is at its pinnacle when government surveillance intrudes on the home; (2) long-term electronic surveillance by the government implicates an individual’s expectation of privacy; and (3) location data generated by cell phones, which are ubiquitous in this day and age, can reveal a wealth of private information about an individual. Applying those principles to the information sought here by the government, the Court finds that individuals have an expectation of privacy in the historical CSLI associated with their cell phones, and that such an expectation is one that society is willing to recognize as reasonable.

This is big. Obviously, the government is likely to appeal, and so as a first pass, this might seem meaningless. We've still got an appeals court (and possibly a rehearing) and a Supreme Court to get to, but as a first ruling, it's a good one. Koh's analysis is pretty thorough. It notes the similarities to both the Jones and Riley cases:

Here, as in Jones, the government seeks permission to track the movement of individuals—without a warrant—over an extended period of time and by electronic means. CSLI, like GPS, can provide the government with a “comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations.” Riley, 134 S. Ct. at 2490 (quoting Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring)). With the proliferation of smaller and smaller base stations such as microcells, picocells, and femtocells—which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home, ...—the government is able to use historical CSLI to track an individual’s past whereabouts with ever increasing precision. See Riley, 134 S. Ct. at 2490 (explaining that a cell phone’s “[h]istoric location information . . . can reconstruct someone’s specific movements down to the minute, not only around town but also within a particular building”). At oral argument, the government agreed that in some instances CSLI could locate an individual within her home, ... and did not dispute that CSLI will become more precise as the number of cell towers continues to multiply.... This admission is of constitutional significance because rules adopted under the Fourth Amendment “must take account of more sophisticated systems that are already in use or in development.”...

In fact, the information the government seeks here is arguably more invasive of an individual’s expectation of privacy than the GPS device attached to the defendant’s car in Jones. This is so for two reasons. First, as the government conceded at the hearing, over the course of sixty days an individual will invariably enter constitutionally protected areas, such as private residences.... Tracking a person’s movements inside the home matters for Fourth Amendment purposes because “private residences are places in which the individual normally expects privacy free of governmental intrusion not authorized by a warrant, and that expectation is plainly one that society is prepared to recognize as justifiable.” Karo, 468 U.S. at 714; see also Kyllo, 533 U.S. at 31 (“At the very core of the Fourth Amendment stands the right of a man to retreat into his own home and there be free from unreasonable governmental intrusion.” (internal quotation marks omitted)). As one court put it, “Because cellular telephone users tend to keep their phone on their person or very close by, placing a particular cellular telephone within a home is essentially the corollary of locating the user within the home.” ....

Second, the government conceded at oral argument that, compared to GPS tracking of a car, the government will “get more information, more data points, on the cell phone” via historical CSLI... (“But, yes, of course the person has the phone more than they have their car, most people at least do, so it gives [the government] more data.”). Cell phones generate far more location data because, unlike the vehicle in Jones, cell phones typically accompany the user wherever she goes.... Indeed, according to a survey cited by the U.S. Supreme Court in Riley, “nearly three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting that they even use their phones in the shower.”....

Judge Koh points to some survey data from Pew (sent in by EFF) noting that many, many people consider their location information to be "sensitive information" and, on top of that, the fact that CSLI is generated even if someone turns off the GPS or "location data" features on their phone -- meaning they can't even opt out of generating such information to try to keep it private.

More importantly, Judge Koh takes on the issue of the infamous third party doctrine and the awful Smith v. Maryland precedent, which says you have no expectation of privacy in data held by third parties. To date, the Supreme Court has punted on this issue in the Jones and Riley cases. However, Koh addresses the issue head on, and says the third party doctrine should not apply to phone location data like this. The key issue: in the Smith case, the "information" that was given to the third party was the phone number being dialed. This was information that the caller voluntarily conveyed to the phone company in order to make the call. Judge Koh points out that this information is quite different:

Cell phone users, by contrast, do not “voluntarily convey” their location to the cellular service provider in the manner contemplated by Miller and Smith. This is especially true when historical CSLI is generated just because the cell phone is on, such as when cell phone apps are sending and receiving data in the background or when the cell phone is “pinging” a nearby cell tower. As the government’s FBI special agent explained, “CSLI for a cellular telephone may still be generated in the absence of user interaction with a cellular telephone.” .... “For example,” the special agent continued, CSLI may be generated by “applications that continually run in the background that send and receive data (e.g. email applications).” ... At oral argument, the government confirmed that its § 2703(d) application authorizes the government to obtain historical CSLI generated by such activities.

[....] In so doing, a cell phone periodically identifies itself to the closest cell tower—not necessarily the closest cell tower geographically, but the one with the strongest radio signal—as it moves through its network’s coverage area.... This process, known as “registration” or “pinging,” facilitates the making and receiving of calls, the sending and receiving of text messages, and the sending and receiving of cell phone data.... Pinging nearby cell towers is automatic and occurs whenever the phone is on, without the user’s input or control.... This sort of pinging happens every seven to nine minutes....

In Miller and Smith, the individual knew with certainty the information that was being conveyed and the third party to which the conveyance was made. Cell phone users, on the other hand, enjoy far less certainty with respect to CSLI. CSLI, in contrast to deposit slips or digits on a telephone, is neither tangible nor visible to a cell phone user. When the telephone user in Smith received his monthly bill from the phone company, the numbers he dialed would appear.... The CSLI generated by a user’s cell phone makes no such appearance.... Rather, because CSLI is generated automatically whenever a cell tower detects radio waves from a cell phone, a cell phone user typically does not know that her phone is communicating with a cell tower, much less the specific cell tower with which her phone is communicating.... It may be, as the government explained, that a cell phone connects to “many towers” during the length of a call,... and the tower to which a cell phone connects is not necessarily the closest one geographically.... Moreover, when an app on the user’s phone is continually running in the background, ... she may not be aware that the cell phone in her pocket is generating CSLI in the first place.

And thus, even with the third party doctrine, this information is quite different than that discussed in the Smith v. Maryland case, which involved phone numbers dialed:

In light of the foregoing, the Court concludes that historical CSLI generated via continuously operating apps or automatic pinging does not amount to a voluntary conveyance of the user’s location twenty-four hours a day for sixty days. Such data, it is clear, may be generated with far less intent, awareness, or affirmative conduct on the part of the user than what was at issue in Miller and Smith. Unlike the depositor in Miller who affirmatively conveyed checks and deposit slips to the bank, or the telephone user in Smith who affirmatively dialed the numbers recorded by the pen register, a cell phone user may generate historical CSLI simply because her phone is on and without committing any affirmative act or knowledge that CSLI is being generated. Smith, for example, never contemplated the disclosure of information while the landline telephone was not even in use.

This sort of passive generation of CSLI does not amount to a voluntary conveyance under the third-party doctrine.

Judge Koh notes that this ruling isn't rejecting the ruling in Smith -- rightly noting that only the Supreme Court can determine that it's no longer good law -- but notes that the ruling there is different enough from this one that it does not apply. Ideally, the Supreme Court will get around to rejecting the ridiculous third party doctrine altogether, but if it must stand, a ruling like this is helpful in returning just a bit of 4th Amendment protected privacy to the American public.

Filed Under: 4th amendment, csli, ecpa, location information, lucy koh, privacy, probable cause, sca, warrant
Companies: aclu, eff