ICANN Loses Yet Again In Its Quixotic Quest To Obtain A Special Exemption From The EU's GDPR

from the oh,-do-give-it-a-rest dept

Back in May, we wrote about the bizarre attempt by the Internet Corporation for Assigned Names and Numbers (ICANN) to exempt itself from the EU's new privacy legislation, the GDPR. ICANN sought an injunction to force EPAG, a Tucows-owned registrar based in Bonn, Germany, to collect administrative and technical contacts as part of the domain name registration process. EPAG had refused, because it felt doing so would fall foul of the GDPR. A German court turned down ICANN's request, but without addressing the question whether gathering that information would breach the GDPR.

As the organization's timeline of the case indicates, ICANN then appealed to the Higher Regional Court of Cologne, Germany, against the ruling. Meanwhile, the lower court that issued the original judgment decided to re-visit the case, which it has the option to do upon receipt of an appeal. However, it did not change its view, and referred the matter to the upper Court. The Appellate Court of Cologne has issued its judgment (pdf), with a comprehensive smackdown of ICANN, yet again (via The Register):

Regardless of the fact that already in view of the convincing remarks of the Regional Court in its orders of 29 May 2018 and 16 July 2018 the existence of a claim for a preliminary injunction (Verfügungsanspruch) is doubtful, at least with regard to the main application, the granting the sought interim injunction fails in any case because the Applicant has not sufficiently explained and made credible a reason for a preliminary injunction (Verfügungsgrund).

The Appellate Court pointed out that ICANN could hardly claim it would suffer "irreparable harm" if it were not granted an injunction forcing EPAG to gather the additional data. If necessary, ICANN could collect that information at a later date, without any serious consequences. ICANN's case was further undermined by the fact that gathering administrative and technical contacts in the past had always been on a voluntary basis, so not doing so could hardly cause great damage.

Once more, then, the question of whether collecting this extra personal information was forbidden under the GDPR was not addressed, since ICANN's argument was found wanting irrespective of that privacy issue. And because no interpretation of the GDPR was required for the case, the Appellate Court also ruled there were no grounds for referring the question to the EU's highest court, the Court of Justice of the European Union.

ICANN says that it is "considering its next steps", but it's hard to see what those might be, given the unanimous verdict of the courts. Maybe it's time for ICANN to comply with the EU law like everybody else, and for it to stop wasting money in its forlorn attempts to get EU courts to grant it a special exemption from the GDPR's rules.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu, gdpr, privacy, whois
Companies: icann

EU And Japan Agree To Free Data Flows, Just As Tottering Privacy Shield Framework Threatens Transatlantic Transfers

from the cooperation-not-confrontation dept

The EU's strong data protection laws affect not only how personal data is handled within the European Union, but also where it can flow to. Under the GDPR, just as was the case with the preceding EU data protection directive, the personal data of EU citizens can only be sent to countries whose privacy laws meet the standard of "essential equivalence". That is, there may be differences in detail, but the overall effect has to be similar to the GDPR, something established as part of what is called an "adequacy decision". Just such an adequacy ruling by the European Commission has been agreed in favor of Japan:

This mutual adequacy arrangement will create the world's largest area of safe transfers of data based on a high level of protection for personal data. Europeans will benefit from strong protection of their personal data in line with EU privacy standards when their data is transferred to Japan. This arrangement will also complement the EU-Japan Economic Partnership Agreement, European companies will benefit from uninhibited flow of data with this key commercial partner, as well as from privileged access to the 127 million Japanese consumers. With this agreement, the EU and Japan affirm that, in the digital era, promoting high privacy standards and facilitating international trade go hand in hand. Under the GDPR, an adequacy decision is the most straightforward way to ensure secure and stable data flows.

Before the European Commission formally adopts the latest adequacy decision, Japan has agreed to tighten up certain aspects of its data protection laws by implementing the following:

A set of rules providing individuals in the EU whose personal data are transferred to Japan, with additional safeguards that will bridge several differences between the two data protection systems. These additional safeguards will strengthen, for example, the protection of sensitive data, the conditions under which EU data can be further transferred from Japan to another third country, the exercise of individual rights to access and rectification. These rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.

A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.

It is precisely these areas that are proving so problematic for the data flow agreement between the EU and the US, known as the Privacy Shield framework. As Techdirt has reported, the European Commission is under increasing pressure to suspend Privacy Shield unless the US implements it fully -- something it has failed to do so far, despite repeated EU requests. Granting adequacy to Japan is an effective way to flag up that other major economies don't have any problems with the GDPR, and that the EU can turn its attention elsewhere if the US refuses to comply with the terms of the Privacy Shield agreement.

The new data deal with Japan still has several hurdles to overcome before it goes into effect. For example, the European Data Protection Board, the EU body in charge of applying the GDPR, must give its view on the adequacy ruling, as must the civil liberties committee of the European Parliament -- the one that has just called for Privacy Shield to be halted. Nonetheless, the European Commission will be keen to adopt the adequacy decision, not least to show that countries are still willing to reduce trade barriers, rather than to impose them, as the US is currently doing.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data flows, eu, japan, privacy, privacy shield, surveillance, us

Canadian Court Affirms Citizens Still Have An Expectation Of Privacy In Devices Being Repaired By Third Parties

from the smallish-bulwark-against-tyranny dept

A Canadian appeals court has decided in favor of greater privacy protections for Canadians. The case involves the discovery of child porn by a computer technician who was repairing the appellant's computer. This info was handed over to the police who obtained a "general warrant" to image the hard drive to scour it for incriminating evidence.

Yes, "general warrants" are still a thing in the Crown provinces. The same thing we fought against with the institution of the Fourth Amendment exists in Canada. These days, it has more in common with All Writs orders than the general warrants of the pre-Revolution days, but there's still a hint of tyrannical intent to them. (Again, much like our All Writs orders, which date back to 1789.) "General warrants" are something the government uses when the law doesn't specifically grant permission for what it would like to do:

A provincial court judge, a judge of a superior court of criminal jurisdiction or a judge as defined in section 552 may issue a warrant in writing authorizing a peace officer to, subject to this section, use any device or investigative technique or procedure or do any thing described in the warrant that would, if not authorized, constitute an unreasonable search or seizure in respect of a person or a person’s property if

(a) the judge is satisfied by information on oath in writing that there are reasonable grounds to believe that an offence against this or any other Act of Parliament has been or will be committed and that information concerning the offence will be obtained through the use of the technique, procedure or device or the doing of the thing;

(b) the judge is satisfied that it is in the best interests of the administration of justice to issue the warrant; and

(c) there is no other provision in this or any other Act of Parliament that would provide for a warrant, authorization or order permitting the technique, procedure or device to be used or the thing to be done.

The appellant's challenge of the general warrant (rather than a more particular search warrant) almost went nowhere, but this decision grants him (and others like him) the standing to challenge the warrant in the first place. As the court notes, handing a computer over to a technician doesn't deprive the device's owner of an expectation of privacy.

In our view, the appellant had standing to argue a violation of his section 8 Charter right to be free from unreasonable search. The Crown concedes that the appellant maintained a reasonable expectation of privacy in the data stored on the computer even after delivery of his computer to the repair shop. Privacy is not an all-or-nothing concept. Allowing a technician to have physical access to the computer for the purpose of carrying out repairs does not amount to a waiver of the appellant’s strong expectation of privacy vis-à-vis third parties such as the police. While the appellant’s expectation of privacy was diminished to the extent that he could reasonably expect the repair technician to examine files on the computer in the course of the repairs, this operational reality does not deprive the appellant of standing to bring a claim under section 8 of the Charter.

Standing helps, but ultimately didn't help the appellant here. The court decides the failure to obtain the proper warrant is indeed a violation, but one not severe enough to trigger suppression of the evidence.

The failure to obtain an ordinary search warrant resulted in, at worst, a technical breach of the appellant’s section 8 Charter rights. There was prior judicial authorization for the search even though it was obtained pursuant to the wrong section of the Criminal Code. A general warrant requires reasonable and probable grounds to believe an offence has been committed, and reasonable and probable grounds to believe the search will reveal evidence of an offence – the same standard a judge would have applied with a traditional search warrant under section 487 of the Code.

The court goes on to note the failure to follow proper procedures when obtaining the warrant (ultimately the wrong sort of warrant) was negligent. It was anything but a "trivial" breach of protocol. Even if the officer's inexperience resulted in erroneous actions, the violation is severe enough for the court to take note of. But this negligence isn't enough to overcome the inevitable outcome of the search, in the court's opinion.

In this case, however, the causal link between the forensic search of the computer’s files and the violation of section 489.1 is very weak. Again, there is no reason to believe that the search of the computer’s files would have unfolded any differently if the officer who seized his computer had complied with section 489.1. On this record, any justice would have authorized the initial police detention of the computer, giving the police three months in which to seek a search warrant. There was no copying of the computer’s hard drive prior to the police obtaining a general warrant, which occurred within that three-month period. While the search of the computer’s files undoubtedly had a very significant impact on the appellant’s privacy interests, the police had sought and obtained judicial authorization prior to conducting the initial search, i.e., the forensic imaging. Although the effects of the breach were not trivial, we would not describe the impact on the appellant’s Charter-protected interest, as being particularly serious…

So, while this didn't end up giving the defendant the suppression he was seeking, it did at least affirm an expectation of privacy in devices being handled and repaired by third parties. Better, the opinion contains the government's concession that this privacy expectation exists. Hopefully, this will help deter violations -- erroneous or not -- in the future.

Filed Under: canada, general warrant, privacy, repairs, third parties

Big News: Big Internet Platforms Making It Easy To Move Your Data Somewhere Else

from the it's-a-start dept

So, just last week we had a post by Kevin Bankston from the Open Technology Institute arguing for some basic steps towards much greater data portability on social media. The idea was that the internet platforms had to make it much easier to not just download your data (which most of them already do), but to make it useful elsewhere. Bankston's specific proposal included setting clear technical standards and solving the graph portability project. In talking about standards, Bankston referenced Google's data transfer project, but that project has taken a big step forward today announcing a plan to let users transfer data automatically between platforms.

The "headline" that most folks are focusing on is that Google, Facebook, Microsoft and Twitter are all involved in the project (along with a few smaller companies), meaning that it should lead to a situation where you could easily transfer data between them. As it stands right now, the various services let you download your data, but getting it into another platform is still a hassle, making the whole "download your data" thing not all that useful beyond "oh, look at everything this company has about me." Making a system where you can easily transfer all that data to another platform without having to manage the transition yourself or being left with a bunch of useless data is a big step forward -- and a huge step towards giving users much more significant control over their data.

But the really important thing that this may lead to is not so much about transferring your data between one of the giant platforms, but hopefully in opening up new businesses which would allow you to retain much greater control over your data, while limiting how much the platforms themselves keep. This is something we've talked about in the past concerning the true power of data portability. Rather than having it tied up in silos connected to the services you use, wouldn't it be much better if I could keep a "data bank" of my data in a place that is secure -- and where if and when I want to I can allow various services to access that data in order to provide the services I want?

In other words, for many years I've complained about how we've lost the promise of cloud computing in just building up giant silos of data connected to the various online services. If we can separate out the data layer from the service layer, then we can get tremendous benefits, including (1) more end-user control over their own data (2) more competitive services and (3) less power to dominate everything by the biggest platforms. Indeed, we could even start to move towards a world of protocols instead of platforms.

Of course, this is only one step in that direction, but it's a big one. And, yes, it's notable that the big platforms are all working on this together, since it has the potential to undermine their own powerful position. But it's absolutely the right thing for them to do, and hopefully we'll start to see much more interesting services pop up out of this. If it only ends up allowing people to shift between Google and Facebook that will be a failure. If it enables new services and more end user control over data -- forcing various services to compete and provide better value in exchange for accessing our data -- that would be a huge step forward in how the internet functions.

Filed Under: competition, control, data portability, decentralization, innovation, lock in, privacy, silos
Companies: facebook, google, microsoft, twitter

Irish Lawmakers Realizing The GDPR's Consent Requirements Seem A Bit Onerous, Want To 'Infer' Consent

from the oh-wait,-that-takes-work dept

Once again, we find lawmakers who seemingly championed "strong privacy" rules like the GDPR suddenly freaking out when they realize such laws might apply to government bodies as well. Once again, we have Jason Smith at Indivigital to thank for highlighting the latest mess. This time it involves Irish lawmakers trying to figure out how different government agencies can share data between those agencies in order to provide better services. But, here's the problem: doing so without "consent" would seem to violate the basic concepts of the GDPR, so the Minister of State for Public Procurement, Open Government and eGovernment, Patrick O'Donovan, decided to try to take the easy way out and say that the government should be able to "infer" consent, if someone made use of the government service in the past:

“That principle is accepted. It is a once only principle where if a person is availing of a service, it could be inferred that there is consent already contained in that by virtue of the fact that they have presented themselves to look for that particular support or service from the State.”

Now, personally, I agree that this seems like a perfectly reasonable standard for inferring consent under most reasonable conditions. But the problem is that the GDPR generally does not view things that way. This is yet another example of where people who view privacy through a singular lens of "don't do anything at all with my data," often fail to realize how extreme that position is, and how it limits perfectly normal functions.

But, in this case, it comes across as just another example of where governments are saying, "do as I say, not as I do..."

Filed Under: consent, data privacy, data protection, eu, gdpr, ireland, patrick o'donovan, privacy

'Smart' TVs Remain The Poster Child For Dismal Privacy, Transparency & Security Standards

from the watching-you-watching-me dept

The dumpster fire that passes for security and privacy standards in the internet of things space is by now pretty well understood. It's also pretty clear that in this sector, "smart TV" vendors have been among the laziest sectors around in terms of making sure private consumer data is adequately encrypted, and that consumers understand that their viewing habits and even some in-room conversations are being hoovered up and monetized, usually sloppily.

Recent studies have found that upwards of 90% of smart TVs can be compromised remotely, and leaked documents have made it clear that intelligence agencies have been having a field day with the lack of security in such sets, easily exploiting paper-mache grade protections in order to use TV microphones to monitor targets without anybody being the wiser.

Meanwhile, set vendors and viewing tracking firms continue to do a pretty dismal job clearly explaining to the end user what data is being collected and monetized. The New York Times, for example, recently did a profile piece on a company named SambaTV, whose viewer-tracking software is now collects viewing data from 13.5 million smart TVs in the United States. Owners of these sets will find Samba's Interactive TV software already installed, and are told that the software simply lets you receive handy recommendations and experience TV "in a whole new way":

"Interact with your favorite shows. Get recommendations based on the content you love. Connect your devices for exclusive content and special offers. By cleverly recognizing onscreen content, Samba Interactive TV lets you engage with your TV in a whole new way."

But at no point during set up does the company really make it obvious just how much data is being collected or how it's used:

"Once enabled, Samba TV can track nearly everything that appears on the TV on a second-by-second basis, essentially reading pixels to identify network shows and ads, as well as programs on HBO and even video games played on the TV. Samba TV has even offered advertisers the ability to base their targeting on whether people watch conservative or liberal media outlets and which party’s presidential debate they watched."

That's certainly something that would never be abused, right? Especially since we keep seeing story after story after story about how anonymized data isn't really "anonymous", such data isn't particularly well protected, and consumers don't actually have the faintest understanding of what's being collected and monetized in the first place. Consumer advocates say that transparency about what data is collected remains utterly lacking, as most users of this software have zero understanding it can potentially even track their political leanings:

“It’s still not intuitive that the box maker or the software embedded by the box maker is going to be doing this,” said Justin Brookman, director of consumer privacy and technology policy at the advocacy group Consumers Union and a former policy director at the Federal Trade Commission. “I’d like to see companies do a better job of making that clear and explaining the value proposition to consumers."

The FTC last year fined TV vendor Vizio $2.2 million for hoovering up the viewing data on 11 million consumer TVs without consumers’ knowledge or consent. But FTC enforcement is inconsistent, and is often slow to address how companies now use numerous devices in concert (your smart phone, your home assistant, and your TV) to deepen in-home surveillance capabilities further. The rabbit hole gets deeper still when you consider that your ISP is also cashing in on your IOT device usage without much transparency or oversight thanks to the recent attacks on privacy rules and FCC authority over ISPs.

Quite often, such data hoovering systems are actively misrepresented as being of ambiguous benefit to the end user. And because users can technically dig through Samba's 4,000 word privacy policy and 6,500 word terms of use to discover what's actually happening (something companies know users won't do and may not even understand if they did), they're technically adhering to the law. Eventually we'll get around to working together on modernizations of the law, but pretty clearly not before years and dozens of additional privacy and security scandals drive the point home.

Filed Under: privacy, security, smart tv, transparency
Companies: samba tv

Oregon Supreme Court Sets Up New Limits For Digital Device Searches

from the if-it-isn't-what-you-said-you're-looking-for,-you-don't-get-to-use-i dept

Searching digital things isn't like searching physical things. But a majority of Fourth Amendment jurisprudence relies on making inapt comparisons between houses/papers and devices capable of holding several housefuls of papers, communications, photos, etc.

Guidelines for digital searches are an inexact science. Given the nature of these searches, there's clearly room for abuse. It's almost inevitable. Access must be granted to an entire device (computer, phone, hard drive) to find what's sought as evidence. Files aren't named incriminating.docx so files must be opened to determine their contents. In almost all digital searches, law enforcement gets the haystack and then goes looking for needles.

The problem with this approach is it allows law enforcement to reroute search efforts (or apply for new warrants) if they happen to discover something incriminating that wasn't exactly what they were looking for. We've already seen this happen in espionage cases (where child porn was discovered) and the FBI's dig into Hillary Clinton's private email server (a search for illicit text messages from Anthony Weiner resulted in the examination of thousands of emails stored by his estranged wife [and former Clinton aide] Huma Abedin).

If law enforcement needs to view unrelated files to find the evidence they've sworn (in an affidavit) they'd find, how do you stop them from using evidence not specifically related to the confines of the search? That's the question the Oregon Supreme Court wrestled with before coming up with an imperfect answer.

The facts of the case are undeniably tragic. Here they are summed up by Orin Kerr, whose own writings on the subject of digital searches are referenced a few times in the court's decision.

Here's a very simplified version of the facts (enough to explain the legal context, no more). The police suspected that Mansor had abused his infant son in a way that led to his tragic death. The police obtained a warrant to search Mansor's computer for evidence of abuse. But the warrant they drafted was incredibly narrow. As construed by the Oregon Supreme Court, the warrant only authorized a search for the Internet search terms that Mansor had entered in to his browser for a specific 15-minute window before Mansor had called 911 to report his son's injury.

The problem with the search is it immediately exceeded the restrictions law enforcement had placed on itself. These restrictions weren't found in the warrant request, which was completely open-ended, but in the instructions the agency passed on to the forensic examiner. From the opinion [PDF]:

The warrant was executed that night. Two laptop computers, two desktop computers, and other items from B’s room were seized. The computers were taken to the Northwest Regional Computer Forensics Laboratory, operated by the FBI, which performed the forensic analysis. The lab’s report summarized the request:

“[Rookhuyzen] requested that the [seized computer drives] be examined for internet history and internet search terms input by the user on [June 12] especially from 2pm onward. Per a discussion with Det. Rookhuyzen, the suspect searched the internet 15 minutes prior to calling 9-1-1 in regards to his 11-week old child suffering injuries. Suspect claimed that the internet searches were regarding how to aid an injured infant. Pertinent examination results should be regarding child abuse and a possible history thereof.”

This self-imposed limitation was almost immediately exceeded. New search terms were added. For no discernible reason, the agency asked forensics to recover emailed messages. Eventually, law enforcement found what it was looking for by removing the time limit placed on internet history/search terms to allow examination of data dating back to 2005 -- five years before the infant at issue was born.

The search results compiled covering the 15-minute window surrounding the original 911 call appeared to track with the suspect's story. Those dating back further indicated a history of abusive behavior towards the infant. The search terms from outside the original proposed range of June 12th (the date of the 911 call) were introduced as evidence of Mansor's motive and mindset.

At trial, Detective Hays relied on the forensic lab’s reports to testify about defendant’s internet history. He stated that shortly before the 9-1-1 call, defendant searched the term “baby pulse no breathing”—a search consistent with defendant’s explanation of events. The focus of Hays’s testimony on defendant’s internet history, however, was computer activity that occurred before that day. Interpreting reports generated by the forensic examiner, Hays concluded that on five separate occasions—the day of the 9-1-1 call and four earlier occasions, the earliest 54 days before the call—the computer had been used to conduct searches about or related to child abuse. The prosecutor implied that the search terms typed into the computer, often in quick succession, provided a snapshot of defendant’s thought process and conduct. For example, three days before the 9-1-1 call, there were many relevant searches, including, at 6:24 a.m., a search for “afraid of abusing my baby,” then shortly after that, “how do I deal with a screaming baby,” then three minutes later, “baby, swelling, back of head.”

This evidence was challenged by Mansor but the trial court ruled the evidence collected fell under the "plain view" warrant exception. Even if law enforcement had exceeded its self-imposed limits, the information would apparently have been uncovered during the course of the lawful search. This ruling ignored the fact that very little of what's uncovered during a forensic search could really be considered "plain view," what with access to deleted files and years of internet activity.

The appeals court reversed this decision, ruling the warrant itself was unconstitutionally broad. It held that ordering a forensic examination of the suspect's computers exceeded what was necessary to obtain evidence related to crime at hand.

The state supreme court comes to a similar conclusion, but for different reasons. The warrant is still overbroad but the remedies and protections flow from the state's Constitution, rather than the US Constitution. Oregon's protections exceed those of the Fourth Amendment.

Addressing the issue of overbroad searches and search warrants, the court hands down this deterrent and avenue for challenge. Citing the Supreme Court's Riley decision and noting its refusal to compare digital devices containing millions of "papers" to yesteryear's "containers" and "pants pockets," the state court finds the most practical way to limit digital searches is to immediately disqualify evidence obtained in excess of the warrant's stated confines.

In our view, the privacy interests underlying Article I, section 9, are best protected by recognizing a necessary trade-off when the state searches a computer that has been lawfully seized. Even a reasonable search authorized by a valid warrant necessarily may require examination of at least some information that is beyond the scope of the warrant. Such state searches raise the possibility of computer search warrants becoming the digital equivalent of general warrants…

[...]

Although such searches are lawful and appropriate, individual privacy interests preclude the state from benefiting from that necessity by being permitted to use that evidence at trial. We thus conclude that the state should not be permitted to use information obtained in a computer search if the warrant did not authorize the search for that information, unless some other warrant exception applies.

It's a new exclusionary rule specifically aligned to Oregon's Constitution that will hopefully deter fishing expeditions or unrelated investigations. But even if it doesn't, it's a challenge that can immediately be raised to presented evidence that goes further than a Fourth Amendment challenge would. Defendants don't have to challenge the validity of the warrant but rather the evidence obtained by it, if it's in excess of the warrant's demands. This may encourage law enforcement to craft broader search warrants, but the language in the first paragraph of the previous quote shows the state's supreme court is already viewing broad digital search warrants with skepticism.

Filed Under: 4th amendment, device searches, oregon, privacy, searches

Trump's Supreme Court Pick: Not Great On The 4th Amendment, But His Take On The Third Party Doctrine Has Already Gone Out Of Style

from the entirely-possible-all-civil-liberties-won't-vanish-immediately dept

Donald Trump gets to roll the Supreme Court dice twice this term (so far!) and he's chosen Judge Brett Kavanaugh of the DC Circuit Appeals Court for the position. Gallons of digital ink have been spilled speculating about his impact on abortion rights, gun control, and immigration. We're also concerned about Kavanaugh's take on two of our favorite amendments: the First and Fourth.

Mike Masnick is taking on the First Amendment implications of Kavanaugh's seat on the Supreme Court bench (Karl Bode has also taken a shot here), so I'll be taking a look at Kavanaugh's record on the Fourth. The most famous case Kavanaugh delivered a ruling on pertaining to the Fourth Amendment also pertains to the Deep State NSA and its bulk collection of phone records.

In denying Larry Klayman's challenge of the Section 215 program, Kavanaugh wrote:

I vote to deny plaintiffs' emergency petition for rehearing en banc. I do so because, in my view, the Government';s metadata collection program is entirely consistent with the Fourth Amendment.

Why is it "entirely consistent?" Because Third Party Doctrine.

The Government's collection of telephony metadata from a third party such as a telecommunications service provider is not considered a search under the Fourth Amendment, at least under the Supreme Court's decision in Smith v. Maryland...

Also, because National Security:

[T]he Government's metadata collection program readily qualifies as reasonable under the Supreme Court's case law. The Fourth Amendment allows governmental searches and seizures without individualized suspicion when the Government demonstrates a sufficient "special need" – that is, a need beyond the normal need for law enforcement – that outweighs the intrusion on individual liberty.

This take on the Third Party Doctrine is now outdated, thanks to both the restructuring of the Section 215 program via the USA Freedom Act and the Supreme Court's recent Carpenter decision. All third party records are not created equal. While the Supreme Court did not roll back the Third Party Doctrine established with Smith v. Maryland, it did remove its coverage of cell site location info, ruling that warrantless acquisition of these records allows law enforcement to use citizens' cellphones as government tracking devices via records collected and stored by service providers. This is going to cause a bit of friction is national security is implicated again, given Kavanaugh's past ties to President Bush II and natsec program authorization as in-(White)house counsel.

It's not all bad news. This paper by Orin Kerr, discussing the "mosaic" approach to privacy expectations and the Fourth Amendment, notes Justice Scalia borrowed language from another rehearing denial by Kavanaugh to determine the placing of a GPS tracking device on someone's vehicle was a trespass necessitating the use of a warrant.

The Supreme Court unanimously agreed that Jones had been the subject of a Fourth Amendment search but divided sharply on why. Writing for a five-justice majority, Justice Scalia followed Judge Kavanaugh's suggestion and held that the installation of the GPS device was a search because it was a trespass on the "effects" of the car.

This perhaps suggests Kavanaugh will follow the other Trump appointee, Justice Gorsuch, in viewing Fourth Amendment issues dealing with tech advancements in a more traditional manner. Not necessarily a bad thing and definitely an interesting tack to take -- terming records generated by devices (but stored by third parties) as "property" still at least partially owned by device users. This approach could continue to carve away at the Third Party Doctrine in the coming years if adopted in other cases.

Other than that, Kavanaugh's position in the DC Court of Appeals gave him the chance to handle a number of cases dealing with the Fourth Amendment, but there doesn't appear to be many pertaining to issues the Supreme Court hasn't already addressed. PoliceOne did hunt down a few of his takes on Terry stops. In both cases, Kavanaugh came down on the side of law enforcement.

In a 2007 case, U.S. v. Bullock, 570 F. 3d 342, Judge Kavanaugh wrote the majority opinion upholding the frisk of a motorist who was stopped for an illegal U-turn and could not produce a vehicle registration or provide the name of the vehicle's owner. The driver was ordered to step out of the vehicle and when the officer frisked him for weapons, he felt a hard object in the driver's pants that the officer believed to be a weapon. When the officer searched the pants, he found crack cocaine and a scale. Judge Kavanaugh's majority opinion considered the nature of the initial stop, the officer's founded belief that the vehicle was stolen and the risk factor involved in vehicle stops to uphold the initial frisk and subsequent search of the driver.

In a subsequent stop-and-frisk case before the D.C. Circuit Court of Appeals, U.S v. Askew, 529 F. 3d 1119 (2008), Judge Kavanaugh wrote a dissenting opinion when the court held that police officers violated the Fourth Amendment when they unzipped a suspected armed robber's jacket and found a gun. The police action of unzipping the coat was done to facilitate eyewitness identification, but Judge Kavanaugh wrote that the unzipping of the coat could be justified as a protective measure under the contours of Terry v. Ohio.

While these are a concern, various courts have already tangled with stop-and-frisk policies, finding it's not so much the stop itself that's problematic, but how the programs are carried out. In every case, courts (and the DOJ itself) have determined the programs disproportionately target minorities. Without reasonable suspicion, these stops are unconstitutional. That's been the crux of the issue. The tendency to engage in biased policing only compounds the problem.

Kavanaugh's appointment probably won't stack the deck in favor of law enforcement on these issues. He's not going to be anyone's idea of a black-robed civil liberties activist, but he's also headed to a court that has surpassed expectations on Fourth Amendment protections in recent years. Old precedent on tech-focused Fourth Amendment issues is no longer undisturbable, thanks to the far-reaching implications of the Supreme Court's Riley decision. Hints of a property-based rationale in a Kavanaugh decision suggests he may find alternate ways to protect privacy without having to disturb the Third Party Doctrine. That would be unfortunate, but better than allowing prior Doctrine-based precedent to remain undisturbed along with the doctrine itself.

Filed Under: 3rd party doctrine, 4th amendment, brett kavanaugh, privacy, scotus, supreme court

State Appeals Court Says Exigency Beats A Warrant Requirement If A Phone Has A Passcode

from the there-is-no-'going-dark,'-I-guess? dept

The Supreme Court's Riley decision made one thing clear: cellphones are not to be searched without a warrant. Somehow, the Georgia Court of Appeals has reached a different conclusion than the Supreme Court of the United States, even as it cites the ruling. [h/t Andrew Fleischman]

It's a decision [PDF] that's decidedly law enforcement-friendly. And it's one that will pair nicely with the FBI's overblown "going dark" assertions. An arrested individual requested his phone so he could retrieve a phone number to give to the officers questioning him. Here's what happened once he had retrieved that info.

Once [Stephens] unlocked his phone, got the information that he needed, the phone was recovered from [Stephens] at that point. It had not locked out, and having the open pass code at that point, . . . I took the phone down the hall to one of our investigators that’s tech savvy and asked him to plug the phone in and do a phone dump, dump the information without reviewing the information and without advising me of anything if he even got anything off of the dump, that the purpose would be for me to be able to obtain a search warrant for the content of the phone. The experience we have is if the phone goes back to password protection, we’re not able to get into it.

A warrant was sought after the data had already been downloaded. Included in the data dump were photos of a gun prosecutors introduced as evidence. The suppression motion challenged the warrantless search. The lower court found a warrant should have been obtained before the data dump began.

The trial court recognized that Stephens had “a right to privacy in the contents of his cell phone,” and also further acknowledged that per Riley v. California, __ U. S. __ (134 SCt 2473, 189 LE2d 430) (2014), “the police may no longer, without a warrant, search such a phone when seized from an arrestee.”

But it also found the officers had a justifiable excuse for the warrantless data grab.

The trial court, however, found that post Riley, “[e]xigent circumstances – such as the risk of imminent loss of data through a remote wipe of the phone – can justify a warrantless search of a seized cell phone.” And, similarly, according to the trial court, police may “take steps to preserve the digital evidence stored in a cell phone while awaiting judicial authorization to search that evidence.” The trial court held that the measure taken here by police of downloading or “dumping” the contents from Stephens’s cell phone without looking at the contents, was permissible under Riley as a “protective step, taken solely to preserve evidence the detective reasonably believed could be destroyed.”

The appeals court sees the trial court's interpretation of Riley and raises.

Here, pretermitting whether the trial court correctly found that the warrantless downloading of the contents of Stephens’s cell phone was permissible under the exigencies exception to the Fourth Amendment, we hold that even if an unlawful search occurred, the evidence acquired from the downloading was admissible under the independent source doctrine.

[...]

Thus, even assuming that the initial downloading was an unconstitutional search, the information subject to the motion to suppress was obtained through the execution of a valid search warrant.

There you have it: two exceptions to the bright line drawn by the Supreme Court. Riley said warrants are needed to search cellphones. The Georgia Appeals Court agrees, but holds that as long as a warrant is obtained at some point in time, the search can happen prior to the acquisition of a warrant.

In this particular case, there's appears to be minimal intrusion. The information used during the trial wasn't acquired until after a search warrant was obtained, at least according to officers' testimony. But allowing searches to take place prior to the acquisition of a warrant encourages bad behavior -- like checking out data dumps for evidence first and building a warrant request around that, rather than the facts known to officers prior to the (warrantless) search.

It also encourages fishing expeditions because a warrantless search has no boundaries. Warrant requests and the judges that approve them set the limitations on the scope of searches, restricting them to only evidence relevant to the criminal allegations laid out in the affidavit. Working backwards from a search to a warrant means the government can redraft its warrant request prior to delivering it to a judge if it sees something else that might make for a better prosecution.

In this case, no search of the data dump occurred before the warrant arrived. That's good but it's not exactly Riley. Exigent circumstances could theoretically apply to any case involving a phone with a passcode, eliminating the warrant requirement and turning it into an afterthought. "Independent source" does the same thing, granting forgiveness for the constitutional violation as long as a warrant is sought post-search. This hole in Riley is somewhat narrowed by the court noting the warrant request wasn't based on any info derived from the data dump. But that only applies to the specifics of this case and that assumes officers won't lie about the chain of events or engage in parallel construction.

It also invites officers to use the "going dark" theory of unbreakable encryption to claim exigent circumstances guide phone searches, rather than the warrant requirement SCOTUS handed down. With cellphone encryption, any momentarily-unlocked phone creates a convenient "exigent circumstance" that's unlikely to be seriously challenged by courts. Even if other tools and workarounds can be used to crack a locked phone, the presence of one temporarily free of roadblocks will be searched to ensure maximum operational efficiency, rather than adherence to the Fourth Amendment as defined by the Riley decision.

This is a bad call by the Appeals Court. It could have found a way to deter future abuse without actually suppressing the evidence. Instead, it gave Georgia law enforcement a road map for warrantless phone searches.

Filed Under: 4th amendment, exigency, georgia, passcode, phone search, privacy, riley, warrant