State Court Confirms The Obvious: There's No Expectation Of Privacy In Text Messages Sent To Other People

from the yet-another-'going-dark'-option dept

A Massachusetts court recently sent out the useful reminder that a person's reasonable expectation of privacy does not extend to other people. In other words, there's an expectation of privacy in sent communications, but only up to the point that someone receives them. (via FourthAmendment.com)

In this case [PDF], the defendant in a drug conspiracy hoped to suppress evidence against him obtained from another person's phone. The lower court allowed Jorge Delgado-Rivera to join a motion to suppress filed by another defendant whose phone was searched by law enforcement following a traffic stop.

The higher court says this was the wrong thing to do.

We conclude that, in the circumstances at issue here, the judge erred in deciding that Delgado-Rivera could join in the motion to suppress to challenge the stop and subsequent search.

Delgado-Rivera should not have been allowed to join in the motion to suppress because he enjoyed no reasonable expectation of privacy, under either State or Federal law, in the text messages sent by him that were stored on a cellular telephone belonging to, and possessed by, another person.

This is a simple enough finding -- one that hasn't been contradicted by any case law here in the United States. (The Supreme Court of Canada, however, has decided the expectation of privacy of the sender carries over to the recipient of communications.) The only analogous case -- cited by the lower court in its ruling-- deals with the findings of the Washington state Supreme Court, which held in 2014 that a message's sender still retains an expectation of privacy. But the twist there is that it only covered messages sent -- but never received -- by the intended recipient. That finding deals with law enforcement's interception of these messages, with an officer posing as the intended recipient in hopes of collecting incriminating communications.

In this case, the messages were sent to the person whose phone was searched. And once they're sent and received, the recipient is free to share the communications with anyone, including law enforcement. That's what happened here, although the "sharing" question has been answered in another opinion, granting the message recipient his motion to suppress. That's detailed in a footnote which shows the supposedly consensual search of the phone most likely wasn't.

At an evidentiary hearing on his motion to suppress, Leonel Garcia-Castaneda argued that Officer Jose Tamez's search of his cellular telephones was non-consensual, at least in part because Garcia-Castaneda can speak and read only in Spanish, and the consent form he signed to authorize the searches was in English. The Commonwealth called Tamez to testify on this issue, but he invoked his right not to incriminate himself under the Fifth Amendment to the United States Constitution and therefore was not available to testify regarding the details of the stop and the subsequent searches. The Commonwealth presented no other evidence regarding the stop. The judge thus determined that the fruits of the search in Texas could not be used as evidence against Garcia-Castaneda.

This raises a question that is never answered in this opinion. If messages being used as evidence against Jorge Delgado-Rivera were obtained with an apparently illegal search of Garcia-Castaneda's phone, wouldn't this invalidate the evidence obtained against Rivera from Castaneda's phone? Apparently not. The court notes it in passing and makes no further mention of it in the rest of the ruling.

It does, however, suggest it would view the expectation of privacy in sent communications a little differently if the messages were encrypted or otherwise protected from being seen by anyone other than the intended recipient:

The Commonwealth notes the absence of evidence suggesting "that [Delgado-Rivera] took any steps to protect the contents of those messages [he sent to Garcia-Castaneda] by, for example, using encrypted messaging applications like Signal or Telegram, or an application that defaults to content deletion such as Snapchat." While the use of such applications, or similar efforts to enhance the privacy or security of the messages at issue, likely would be relevant to the extent that it reveals a defendant's efforts to protect his or her privacy, we leave for another day an issue that was not briefed by the parties and is not presently before us.

But the addition of encryption/self-destruction to messaging won't necessarily establish an expectation of privacy. Recipients can decrypt messages and share them or take screenshots of messages before they're destroyed. The senders of messages generally aren't expecting to share the contents of those communications with law enforcement, but there's very little preventing law enforcement from obtaining the contents from the receiving end of those communications.

Even with the seemingly illegal phone search in the mix, the court is right: there's no expectation of privacy. But there appears to be an unanswered question about the legality of the evidence being used against Delgado-Rivera. If was obtained via an illegal search, it should be suppressed, even if there's no expectation of privacy in messages he sent to someone else. But from what's said here, it appears Rivera will need to submit his own motion to suppress, rather than hitchike on his codefendant's suppression attempt.

Filed Under: 3rd parties, expectation of privacy, privacy, recipients, text messages

Court To Cops: No Expectation Of Privacy In A 'Beer-Drinking, Nap-Taking Hideout'

from the try-doing-some-work-sometime dept

Everyone has rights, even the people who often disrespect the rights of others. But those rights can only be violated in certain, specific ways and the two cops, who sued over alleged rights violations, didn't actually have their rights violated.

Officers Denis Lawlor and Daniel Varallo once worked for the Metropolitan Water Reclamation District (MWRD) in Chicago. They were fired after some of their candid comments about their work ethic and coworkers were inadvertently publicly broadcast on a Illinois State Police channel. These comments were recorded and turned over to the officers' employer, which correctly decided these two officers should find somewhere else to work. (via FourthAmendment.com)

Lawlor and Varallo arrived at work and set about doing what they apparently normally did: nothing. This isn't an assumption. It's what they admitted to during the conversation they thought they were having privately. However, the officers' expectation of privacy isn't the same as the Fourth Amendment's expectation of privacy, even if they were safely (or so they thought) ensconced in a "break room with a lock in a secluded area… during the sparsely manned night shift."

But first comes the First. The fired cops claimed they were retaliated against unlawfully for their protected speech. The court doesn't think much of this argument, especially since the plaintiffs did all they could to avoid discussing the content of the speech they claimed was protected. From the decision [PDF]:

[T]he evidence before the Court suggests that the speech was not a matter of public concern. Plaintiffs characterize their statements as “street vernacular and non-politically correct language.” But Plaintiffs avoid pleading the actual contents of their conversation or any specific statements that prompted the adverse employment action. Some of the specific statements that prompted Plaintiffs’ termination, however, were contained in the Decision of the MWRD Civil Service Board setting out the reasons for Plaintiff Lawlor’s termination.

The Civil Service Board noted that Plaintiff Lawlor:

• “informed [Varallo] how to drink alcohol” while on duty,

• explained how he slept on duty by saying “I just set the alarm on my phone (inaudible) for every F***ing hour and fifty-eight. So I call in at fifty-nine, go right back to f***in’ sleep. After you call in at five o’clock, set that motherf***er for six o’clock, you know so you get up to come and do your f’**ing trunk checks,”

• referred to Martin Luther King Day by saying “White guys should call it James Earl Ray Day,”

• Saying of African American co-workers that “It was the n***er laborers that f***in’, that f***ed us,”

• and, in referring a specific African American co-worker, saying “So that stupid Alabama hill n***er is going to think I’m the one that’s trying to bring in relief people who cut down my overtime?”

Yes, this speech is protected. But it's not without consequences. The issue here is retaliation and only certain speech is protected under this element of the First Amendment. The stuff said here just doesn't cut it.

Plaintiffs cite no authority—and the Court is not aware of any—establishing that admissions of drinking and sleeping on the job, or using racial slurs towards co-workers, meet the first requirement for stating a First Amendment retaliation claim.

As for the Fourth Amendment claims, they're no better. The court says the arguments raised by the plaintiffs are ridiculous, not reasonable.

The question before the Court is whether society is prepared to recognize as reasonable an on-duty police officer’s expectation of privacy in a room used to sleep and consume alcohol on the job without his supervisors’ knowledge. Common sense says the answer is “no,” and Plaintiffs cite no authority to the contrary.

The room that supposedly held the officers' expectations of privacy was actually accessible by other MWRD officers seeking to while away the workday not doing any work.

Plaintiffs do not allege that this “break room” was given to them by the MWRD for their “exclusive use” or that no one else had access to the room (rather than that it was unlikely anyone else would access the room). In fact, it was a secret room hidden from MWRD supervisors, and Plaintiff Lawlor named several other employees who had access to the area.

The court reiterates its point about reasonableness and the Fourth Amendment.

[E]ven if Plaintiffs had subjective expectations of privacy in their beer-drinking and nap-taking hideout, society does not appear ready to recognize them as objectively reasonable.

So, what have these officers (hopefully) learned? Several things. First, protected speech can be protected and still have negative consequences. The Fourth Amendment doesn't cover "private" conversations that are inadvertently publicly broadcast. And, if you insist on suing the manufacturer of the handsets that supposedly malfunctioned -- resulting in your termination -- you might get hit with sanctions.

Unsurprisingly, Motorola suggests that Plaintiffs violated Federal Rule of Civil Procedure 11(b) and seems to be considering a motion for sanctions under Rule 11(c)(2).

Cops have rights. But their rights work like they work for us. They don't get extra First or Fourth Amendment rights just because. They already have extra rights, like qualified immunity -- something that compounds the defeat suffered here as the court also grants qualified immunity to the State Police and the MWRD for their actions in this case. Maybe if these officers spent more time working and less time drinking, sleeping, and making racist statements about their coworkers, they'd still be employed.

Filed Under: chicago, daniel varallo, denis lawlor, expectation of privacy, illinois state police, mwrd, police, privacy

New York State Appellate Court Says Cell Site Location Records Have No Expectation Of Privacy

from the may-our-children-look-back-at-these-decisions-and-laugh-over-their-avocado-toast dept

The Supreme Court will deliver its ruling on the issue of cell site location info later this year, possibly changing the contours of the Third Party Doctrine for the first time since its erection out of thin air more than four decades ago. Until then, a patchwork of decisions has been handed down by state courts, some finding state law provides more protection for cell phone users than the US Constitution. At the federal level, however, years of precedent has resulted in a mostly-unified front by appellate courts. According to their decisions, cell site location info is a third-party record, undeserving of Fourth Amendment protections.

One of New York State's appellate courts has sided with the federal level. According to its recent decision, there are no privacy expectations in CSLI collected and stored by cell phone providers.

[W]e conclude that the acquisition of that information was not a search requiring a warrant under either the federal or state constitution. As the People point out, this case involves only historical cell site location information, contained in the business records of defendant's service provider, which placed his phone within a certain cell site "sector" at the time he used the phone to make calls, send text messages, or receive calls or messages.

Under these circumstances, we conclude that the acquisition of the cell site location information was not a search under the Fourth Amendment to the federal constitution because defendant's use of the phone constituted a voluntary disclosure of his general location to his service provider, and a person does not have a reasonable expectation of privacy in information voluntarily disclosed to third parties…

The court goes on to declare that even if it had felt like suppressing the evidence and extending privacy protections to CSLI, it wouldn't have helped the defendant.

As a final matter, we agree with the People that any error in the court's refusal to suppress defendant's cell site location information is harmless. The evidence of defendant's identity as a participant in the crime is overwhelming, and there is no reasonable possibility that the verdict would have been different if the location information had been suppressed…

This decision will stand even if the Supreme Court upends 40+ years of Third Party Doctrine rulings. Decisions like these are rarely retroactively applied. Even if Carpenter wins his Supreme Court case, it's likely the lower court will allow the evidence to remain in play, pointing out officers were reasonable to rely on precedential decisions finding no Fourth Amendment protections for third party records. The same goes for the defendant here. Post-decision alterations to the contours of the Constitution rarely help those whose rights have been determined to be violated after the fact.

Filed Under: 4th amendment, cell site location info, csli, expectation of privacy, location info, new york, privacy

Canadian Supreme Court Says Privacy Protections Apply To Sent Text Messages Obtained From The Recipient

from the fresh-take-on-stale-privacy-laws dept

In the US, the Fourth Amendment protects the privacy of conversations… up to a point. The government can't open mail or intercept phone calls without a warrant. Thanks to a fairly recent Supreme Court decision, the government can't access the contents of a person's phone -- home to a great many conversations -- without a warrant.

But the Fourth Amendment only covers so much. It doesn't stop the recipient of communications from revealing them to anyone else, the government included. Any person can hand over communications to the government voluntarily even if the sender of those messages assumed -- or stated -- they were supposed to be confidential. This is part of the reason why the "going dark" problem has been overstated. The government has multiple ways to access communications without having to crack open a cell phone.

Communications are only as private as all participants feel they are. That's the way the Fourth Amendment has been read in the US. In Canada, there's an equivalent protection under Section 8 of the Canadian Charter of Rights and Freedoms. Contents of communications require warrants to access and the searches themselves must be "reasonably" supported by probable cause.

Canada's highest court has found, in contrast to US judicial views, an expectation of privacy can still be found in messages sent to someone else -- even if those messages are retrieved from the recipient.

In a potentially significant 5-2 ruling*, the high court set aside the convictions against Nour Marakah, whose messages were found by Toronto police on the mobile phone of an alleged accomplice.

The court said Marakah had a reasonable expectation of privacy concerning the messages, meaning he had a right to challenge the police search of the phone as a violation of his guarantees under the Charter of Rights and Freedoms.

In her reasons for the majority, Chief Justice Beverley McLachlin noted that Marakah was the author of the text messages introduced as evidence against him, that he expected the electronic conversation to remain private and that he asked recipient Andrew Winchester numerous times to delete the messages.

*[Note: Ruling not provided by the Globe and Mail for whatever reason. -1 to G&M's JOURNALISM skill.]

There's no bright line being drawn, despite initial appearances, but it will make it much easier for defendants to challenge evidence obtained without a warrant from the recipient of messages. The court [PDF] has this to say about the bar defendants must reach to basically challenge warrantless searches performed on someone else.

Text messages that have been sent and received can, in some cases, attract a reasonable expectation of privacy and therefore can be protected against unreasonable search or seizure under s. 8 of the Charter. Whether a claimant had a reasonable expectation of privacy must be assessed in the totality of the circumstances. To claim s. 8 protection, claimants must establish that they had a direct interest in the subject matter of the search, that they had a subjective expectation of privacy in that subject matter and that their subjective expectation of privacy was objectively reasonable. Only if a claimant’s subjective expectation of privacy was objectively reasonable will the claimant have standing to argue that the search was unreasonable.

The court says there's perhaps nothing so inherently private as a text message -- a conversation that can't be overheard by anyone in close proximity nor even observed with any certainty by those in the immediate vicinity.

The millions of us who text friends, family and acquaintances may each be viewed as having appropriated a corner of this electronic space for our own purposes. There, we seclude ourselves and convey our private messages, just as we might use a room in a home or an office to talk behind closed doors.

Because texting is an inherently private act, the court finds privacy cannot be dispelled simply by approaching other participants in a private conversation.

An individual does not lose control over information for the purposes of s. 8 of the Charter simply because another individual possesses it or can access it. Nor does the risk that a recipient could disclose an electronic conversation negate a reasonable expectation of privacy in an electronic conversation.

The government obviously did not expect the Supreme Court to reach this conclusion. It made a significant concession which has come back to haunt it.

The Crown concedes that if M had standing the search was unreasonable. The text messages are thus presumptively inadmissible against him, subject to s. 24(2) of the Charter.

That concession, along with actions the police took to access the messages, sees the Supreme Court tossing the obtained evidence along with the conviction.

In considering whether this evidence should be excluded under s. 24(2), society’s interest in the adjudication of M’s case on its merits is significant. The text messages offer highly reliable and probative evidence in the prosecution of a serious offence and their exclusion would result in the absence of evidence by which M could be convicted. This favours admission. However, the police conduct in accessing and searching the electronic conversation through W’s iPhone without a warrant two hours after his arrest was sufficiently serious to favour the exclusion of the evidence. This breached s. 8 of the Charter not only because of the extent of the search, but also because of its timing. On the application judge’s findings, this simply was not a search incident to arrest. In addition, the police conduct had a substantial impact on M’s Charter-protected privacy interest in the electronic conversation. On balance, the admission of the evidence would bring the administration of justice into disrepute. It must therefore be excluded under s. 24(2).

With this unusual ruling, things will get more difficult or more streamlined for law enforcement access to communications, depending on how you view it. It will be more difficult because cops won't be able to perform warrantless searches of devices owned by text message recipients. But it will make law enforcement's job easier in a way. When targeting communications, warrants will be needed if the government wants to guarantee its evidence survives a challenge.

This ruling puts text messaging roughly on the same judicial grounding as wiretaps. In both cases, law enforcement is able to access communications between people, even if only one person is actually the investigation's target. The same thing happens here: if cops want complete conversations, albeit ones delivered through messaging services, they'll need warrants to access them from either end.

Things are shifting dramatically in the upper reaches of judicial systems as a response to a sea change in preferred communication methods. Wiretaps on landlines used to be the ultimate invasion of privacy, subject to multiple restrictions. Just because these communications have shifted from landlines to text messaging shouldn't mean they're afforded less privacy just because of the route they've taken.

Filed Under: canada, expectation of privacy, privacy, supreme court, text messages, third party doctrine

FBI Found To Be Harvesting Surreptitious Recordings Around Two Other California Courthouses

from the bugging-in-bulk dept

Earlier this year, the FBI was catching heat for some undersupervised and overly-broad surveillance it deployed around the San Mateo courthouse in California. Hoping to catch conversations related to suspected bid-rigging during real estate auctions, the FBI scattered hidden microphones around the courthouse steps where the auctions took place.

The defendants' legal representation raised hell, claiming the surreptitious recordings violated their clients' rights. After all, the Supreme Court had declared in 1967 that closing a phone booth door was not dissimilar to holding a conversation in hushed tones, bringing a limited expectation of privacy to public places.

The FBI couldn't have felt all that confident about its secret recordings as it vowed not to enter any of the conversations it captured into evidence. That wasn't enough for the judge, however, who said he still needed to determine whether other evidence had been tainted by this questionable surveillance.

Not only was there a question about the legality under the Fourth Amendment, but there were unanswered questions about how many completely irrelevant conversations the FBI's bugs might have picked up -- like privileged discussions between lawyers and clients, both of whom are often at courthouses simultaneously.

Apparently, the FBI thought it was going to get away with this, most likely by declaring anything that happens in public to be completely stripped of privacy expectations. The surreptitious recordings in San Mateo didn't go nearly as smoothly as planned and now evidence has been produced showing the FBI targeted more than one courthouse during its bid-rigging investigation. (via Nate Cardozo)

At the Rene C. Davidson Courthouse in Oakland, the FBI planted hidden microphones inside light fixtures on the courthouse’s exterior steps to capture the conversations of people attending the foreclosure auctions. Cameras and microphones were installed in parked Alameda County vehicles next to the courthouse. The FBI even hid a microphone in the AC Transit bus stop on Fallon Street, and dropped a bugged backpack next to a statue inside the courthouse, according to a letter sent by US Justice Department attorney Kate Patchen to Marr's attorneys on March 15. The surveillance was ongoing from March 2010 to January 2011.

And:

In Martinez, the FBI planted microphones in bushes, at a bus stop, on a pole, and inside parked and roving vehicles near the auction site.

Three courthouses. At least a dozen microphones. Hundreds of hours of recordings. And for what?

Tough to say. Multiple prosecutions of suspected bid-riggers are ongoing, but the investigative groundwork is failing to pass inspection. Once again, prosecutors are promising not to use the questionable recordings in court, but they're far less likely to drop any evidence springing from those captured conversations.

In addition, defendants' lawyers in the San Mateo County case are going so far as to claim the FBI committed felonies by recording conversations, as California is a two-party consent state. They might have to settle for some suppressed evidence though, as the state law has a fairly broad "public area" exception, which would cover courthouse steps and bus stops. But that interpretation of the state's wiretap law exceptions may be subject to the government's interpretation of public spaces from its 1967 Katz decision, which would grant hushed conversations in public an expectation of privacy.

The FBI -- through its actions -- is repeatedly demonstrating it cares little for the rules that govern its investigations and intelligence gathering. It only cares when it gets caught. This is its culture, something that traces back -- with only minimal interruption -- to its inception.

Filed Under: california, courthouses, expectation of privacy, fbi, recordings, surveillance, warrants

Courts, DOJ: Using Tor Doesn't Give You A Greater Expectation Of Privacy

from the IP-addresses-all-the-way-down dept

When is a reasonable expectation of privacy unreasonable? When the government says it is.

In this month alone, we've had two federal judges and the DOJ state that there's no expectation of privacy in IP addresses. This would normally be something covered by the Third Party Doctrine -- where an IP address is part of the records retained by ISPs, and therefore, can be accessed with subpoenas rather than warrants.

The twist, though, is that all of these statements were made in reference to people who made an active effort to obscure their IP addresses by using Tor.

On February 1st, the judge presiding over the Jay Michaud case -- the one where the FBI (for the second time in recent history) ran a child porn website for two weeks in order to gather evidence on visitors to the site -- stated that Tor users had no reasonable expectation of privacy, despite their privacy-protecting efforts. Michaud was challenging the FBI's use of a standard warrant to deploy its NIT (Network Investigative Technique) -- a piece of malware that gathered information about computers connecting to the child porn website.

US district judge Robert J. Bryan denied the motion, noting that while the warrant technically violated the rule, a higher court's interpretation provides an exception for when the information sought could have been discovered by “other lawful means."

To prove this, the judge bizarrely argued that Tor doesn't give its users complete anonymity because a user has to give their IP address to their Internet Service Provider to connect to the Tor network. Therefore, he concluded, Michaud's IP address was “public information, like an unlisted telephone number” that “eventually could have been discovered.”

In doing this, the judge agreed with the assertions the DOJ made in its earlier motion. The DOJ claimed Michaud's IP address was something he shared with third parties -- despite his use of Tor -- and was info the government would have eventually discovered one way or another, even without the use of its controversial hacking tool.

“[E]ven if a defendant wants to seek to hide his Internet Protocol address through the use of Tor, that does not cloak the IP address with an expectation of privacy,” the government wrote, in a statement very similar to the opinion later written by Judge Bryan. “While Michaud may have a reasonable expectation of privacy in stored information contained on his computer, he lacks a reasonable expectation of privacy in IP address information that belongs to an internet service provider and that is voluntarily shared with others in the course of Internet communications.”

The interesting thing about this assertion is that Michaud voluntarily shared his IP address with others. It would seem fairly obvious there was nothing "voluntary" about this exposure. While it's true that IP addresses are "shared" with Tor when connecting, that information is stripped from communications as they travel through the Tor network.

The government argued the NIT merely rerouted this information to the FBI before Tor stripped it. Michaud apparently should have known his use of a privacy-protecting network would perhaps expose his IP address to others, including the FBI.

But as Tor itself states, without intervention from other parties, this information would not be collected by Tor, nor passed along its network.

It is clear that the court does not understand how the Tor network works. The entire purpose of the network is to enable users to communicate privately and securely. While it is true that users "disclose information, including their IP addresses, to unknown individuals running Tor nodes," that information gets stripped from messages as they pass through Tor's private network pathways.

This statement is in response to another judge's declaration that people who utilize additional privacy protections when browsing the web still have no expectation of privacy in their IP addresses. This nearly-identical assertion was made by the judge presiding over the Silk Road 2.0 prosecution of Brian Farrell. In this case, the Defense Department (home of the NSA!) paid Carnegie Mellon researchers to attack the Tor network in order to expose identifying info about its users. The FBI followed along behind the DoD, firing off subpoenas to obtain this newly-discovered information.

The judge in this case wrote:

From the record, it appears the only information passed on to law enforcement about the defendant was his IP address. There is nothing presented by the defense, other than rank speculation, that anything more was obtained by SEI and provided to law enforcement to identify the defendant.

The Court agrees with the government that applicable Ninth Circuit authority precludes the defendant’s success on his motion. SEI’s identification of the defendant’s IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny. The Court reaches this conclusion primarily upon reliance on United States v. Forrester, 512 F.2d 500 (9th Cir. 2007). In Forrester, the court clearly enunciated that: “Internet users have no expectation of privacy in …the IP address of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.”

The court goes on to say it's too bad Tor users expected more protection from the service, but their expectations are not "reasonable" under the Fourth Amendment.

In the instant case, it is the Court’s understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that their communications can be directed toward their destinations. Under such a system, an individual would necessarily be disclosing his identifying information to complete strangers. Again, according to the parties’ submissions, such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under these circumstances.

A subjective expectation of privacy is in no way comparable to the historic view of the objective, reasonable expectation of privacy. Tor users may be taking extra steps to obscure their IP addresses, but two court rulings clearly state the judicial system won't be granting them any "extra" protection from government subpoenas. In fact, these rulings simply make it easier for the government to defend the intrusive techniques it deploys to unmask Tor users by declaring that, underneath it all, it's all about IP addresses, rather than users taking proactive steps to better protect their privacy. It's not quite a blank check for hacking, but it's close. As long as the target is information not historically awarded Fourth Amendment protections, courts will be hard-pressed to question the means used to achieve these ends.

Filed Under: 4th amendment, courts, doj, expectation of privacy, privacy, tor

Prosecutors Argue Cell Site Location Data Is Something Every User Shares With 'The Rest Of The World'

from the no-expectation-of-privacy-in-things-we-insist-everyone-knows dept

The state of Maryland's defense of the Baltimore PD's warrantless use of Stingray devices continues, taking the form of a series of motions unofficially titled Things People Should Know About Their Cell Phones.

The last brief it filed in this criminal prosecution claimed "everyone knows" phones generate location data, therefore there's no expectation of privacy in this information. As commenters pointed out, people may know lots of stuff about records they're generating, but that doesn't mean law enforcement should have warrantless access to those records.

Everyone Knows… That my Doctors generate medical data about patients, so how about we get their medical records on public display without warrants!

With no expectation of privacy, there's no need for a warrant. And with no warrant requirement, there's no chance of having evidence tossed. That's a win Maryland needs, considering the Baltimore PD alone has deployed IMSI catchers several thousand times without obtaining warrants. Everything runs through pen register orders, which both lower the burden of proof and (in many cases) obscure the technology actually being used.

Now, it's back with its response to the defendant's motion to dismiss and it's again claiming People Know Stuff, therefore no expectation of privacy. (h/t Brad Heath)

After dismissing the defendant's arguments about police use of location tracking devices as "dystopian fantasies," the state argues it's time for the accused (not just this one, but any others facing prosecutions predicated on warrantless cell phone tracking device usage) to stop pretending they don't know how much data their phones are coughing up.

While cell phones are ubiquitous, they all come with "off" switches. If a cell phone is turned on, it is receiving signals from cell towers, and sending signals back out to cell towers. The cell site simulator used in this case took advantage of that fact in order to locate Andrews's phone. Because Andrews chose to keep his cell phone on, he was voluntarily sharing the location of his cell phone with third parties. Under the doctrine set forth by the Supreme Court in Smith, supra, he cannot claim a Fourth Amendment privacy right in this case.

The "Smith" the state refers to is 1979's Smith v. Maryland, which law enforcement loves to use in cell phone surveillance cases, because:

a) it's incredibly outdated, and
b) it provides a very broad and favorable reading of the Third Party Doctrine as it relates to phone usage.

The state says it's the defendant's own fault he was located. After all, he had a choice. And he chose badly.

Andrews complains that the police "invaded" a "constitutionally protected area," and therefore this search triggered Fourth Amendment protections under United States v. Karo, 468 U.S. 705 (1984) and Kyllo v. United States, 533 US. 27 (2001). But in Karo, the suspect was unaware that he had brought a police transponder into his home, and in Kyllo, the suspect was unable to prevent grow-lights (or his body) from emitting heat. Andrews, by contrast, was quite aware that he was bringing his own cell phone into the house. And he was quite capable of turning it off

The government's argument, while technically solid when used in conjunction with these precedent-setting decisions (Smith's outdated view of phones notwithstanding), but it becomes completely disingenuous when it describes the "sharing" of identifying phone data.

Just as the telephone company in Smith used transmitted phone numbers in a way quite distinct from the way in which the police used them, so, too, Andrews's cell service provider used the ID number broadcast by his cell phone in ways quite distinct from the way in which the police used it. The way in which the information was used does not alter the "expectation of privacy" in the information itself. Smith controls here. Andrews's addition of the adjective "exact" to the noun "location" does not alter that fact. The issue is not whether Andrews was aware that the police could find the location of his cell phone to within 20 yards. The issue is whether Andrews can claim an objectively reasonable expectation of privacy in information which he was voluntarily broadcasting to third parties at all times. Under Smith, the answer is no.

There is no Fourth Amendment right to evade a valid arrest warrant. Andrews was wanted on multiple counts of attempted murder. A life "on the lam" may require some inconveniences, such as not staying in one's home, and turning one's cell phone off when not in use. There is no constitutional right to avoid being arrested for one's crimes, and nothing unreasonable about the police using the same information that Andrews was sharing with the rest of the world to apprehend him.

The "rest of the world?" Really? Andrews may have been able to talk his cell phone provider into turning over a copy of all the data his phone had generated, but it's not as though the general public has access to this information, expectation of privacy or no. Just because law enforcement can access this information with warrants or (more likely) pen register orders does not make it information "shared" with "the rest of the world." It is not shared indiscriminately and it's only because cell providers are legally compelled to cooperate with law enforcement (CALEA, etc.) that cops can obtain this information with a pen register order, rather than a warrant.

And, in this case, the information was not obtained with a court order. There may be a court order on record that would give the impression the BPD would approach a telco for phone records, but the actual collection of Andrews' location info was done with a Hailstorm cell tower spoofer. The state claims the request specified the use of a cell tower spoofer but there's no indication the presiding judge had any idea how much information these devices can obtain. A pen register order refers to a targeted phone number. A cell tower simulator gathers information from everyone in the area.

This isn't just a fight over this particular prosecution. This is the state safeguarding its thousands of Stingray deployments. If it's going to be able to keep those prosecutions from falling apart -- now that the BPD's devices are an open secret -- it needs the court to agree there's no expectation of privacy in cell phone location data. And in order to do that, it apparently needs the court to believe everyone using a cell phone is sharing all sorts of information with "the rest of the world."

Filed Under: 4th amendment, baltimore, expectation of privacy, location, location data, maryland, privacy, third party doctrine

Prosecutors Say Cops Don't Need Warrants For Stingrays Because 'Everyone Knows' Cell Phones Generate Location Data

from the we'll-let-you-know-when-you-have-an-expectation-of-privacy dept

Up in Baltimore, where law enforcement Stingray device use hit critical mass faster and more furiously than anywhere else in the country (to date...) with the exposure of 4,300 deployments in seven years, the government is still arguing there's no reason to bring search warrants into this.

The state's Attorney General apparently would like the Baltimore PD's use of pen register orders to remain standard operating procedure. According to a brief filed in a criminal case relying on the warrantless deployment of an IMSI catcher (in this case a Hailstorm), the state believes there's no reason for police to seek a warrant because everyone "knows" cell phones generate data when they're turned on or in use. (h/t Brad Heath of USA Today)

The whereabouts of a cellular telephone are not "withdrawn from public view" until it is turned off, or its SIM card removed. Anyone who has ever used a smartphone is aware that the phone broadcasts its position on the map, leading to, for example, search results and advertising tailored for the user's location, or to a "ride-sharing" car appearing at one's address. And certainly anyone who has ever used any sort of cellular telephone knows that it must be in contact with an outside cell tower to function.

The state's brief folds in parts of the Third Party Doctrine and the Supreme Court's 1979 Smith v. Maryland decision to make a truly terrible argument that because certain aspects of cell phones involuntarily create location data, the Fourth Amendment never comes into play.

Matt Blaze rephrases the state's argument slightly, exposing the ridiculousness of this assertion.

"People let people into their houses sometimes, therefore no warrant is needed to search houses". Or something. https://t.co/XncuaZvdwW

— matt blaze (@mattblaze) January 14, 2016

"People let people into their houses sometimes, therefore no warrant is needed to search houses". Or something.

The state follows this up by arguing that, because the use of a pen register order to deploy an IMSI catcher is not expressly forbidden by local statutes, the evidence shouldn't be suppressed.

There was no cellular tracking device statute in effect at the time. There was an order from a neutral magistrate, finding probable cause to authorize precisely what was done in this case; the closest applicable statute does not contain an exclusionary provision. Thus, the court erred in excluding evidence in this case.

All well and good, except that the only reason there was no statute in place is because local law enforcement spent years keeping its cell phone tracking devices hidden from judges and defendants, obscuring the technology through parallel construction and misleading pen register order requests. This case is no different than the hundreds preceding it. The magistrate judge signing the pen register order had no idea what the Baltimore PD was actually doing. The presiding judge in this prosecution declared the Baltimore PD's pen register request contained "material misrepresentations" on his way towards granting the suppression of evidence.

For the state to claim everything was above board and no Fourth Amendment violations occurred is rather audacious, considering it spent months dodging discovery requests related to the methods used to locate the defendant.

The request, asking for no more than what the State was compelled to disclose pursuant to Maryland Rule 4-263, sought: 1) "records, notes, and documents" relating to the Baltimore Police Department's investigation into a second suspect from the April 27, 2014 shooting; as well as 2) information "indicating how Mr. Andrews was located at 5032 Clifton Avenue."

Over two months later, on January 8, 2015, the State responded to the discovery request. The State claimed not to "possess information related to the method used to locate the Defendant at 5032 Clifton Avenue." (T1 9) This turned out to be false.

In fact, the state did not turn over its IMSI catcher-related information until mid-May 2015, more than seven months from the point it was originally requested. That's a long time to withhold information on a Hailstorm deployment the state now claims was both perfectly legal and intruded on no one's privacy.

Filed Under: 4th amendment, baltimore, cell phones, expectation of privacy, hailstorm, imsi catchers, police, stingrays, warrants

Courts Aren't Buying Dispensary-Raiding Cops' 'Expectation Of Privacy' Arguments

from the 'expectation-of-privacy'-isn't-'expectation-of-not-getting-caugh dept

We recently covered the complete absurdity that is the Santa Ana police union's legal battle to clear cops caught misbehaving (to put it lightly…) during a raid on a pot dispensary. The cops in question tore cameras out of the wall, disabled the surveillance system and then, when they thought they were "safe," made disparaging comments about a disabled woman, ate presumably pot-laced edibles, played a few rounds of darts and generally behaved like any group of miscreants would if they felt they were unobserved.

Among the numerous laughable claims made in the union's effort to block recordings of these actions from being used against the cops performing these actions is that the recording itself is "illegal" as the officers had an "expectation of privacy" while performing their law enforcement duties in a public areas of a publicly-accessible business.

The suit also claims the video shouldn't be used as evidence because, among other things, the police didn't know they were on camera.

"All police personnel present had a reasonable expectation that their conversations were no longer being recorded and the undercover officers, feeling that they were safe to do so, removed their masks," says the suit.

First off, any expectation of privacy only arose because the officers thought they had disabled all of the cameras. In any other reasonable situation, the presence of cameras would alert both police and members of the public that any expectations of privacy were severely misguided. Surveillance cameras in businesses are the rule, not the exception. Just because these cops missed a camera doesn't make the recording "illegal," nor does it somehow grant them an expectation of privacy that logically doesn't exist.

The legal action seems doomed to failure, even more so now that the Ninth Circuit Appeals Court -- whose jurisdiction includes Santa Ana, California -- has just issued an opinion, backed by Supreme Court decisions, stating that public areas of public businesses carry no expectation of privacy.

This ruling sides with law enforcement over a citizen's objections -- the same thing the misbehaving cops are seeking, but completely in reverse.

In this case, a motel owner (Mahesh Patel) claimed Fourth Amendment violations were committed when officers entered his business and cited him for code violations in plain view. He claimed his private business (as in private ownership) granted him an expectation of privacy that was violated by the officers' entry.

Not so, says the court:

As in Barlow's, the police officers entering the public areas of the Galleria Motel are entitled to observe (without a warrant) anything observable by the public. Camara and See [Supreme Court cases cited by the plaintiff] only allow a commercial property owner to manifest a reasonable expectation of privacy in his property by closing off portions of his business to the public.

[...]

The areas of the Galleria Motel open to the public are not within the enumerated items in the Fourth Amendment; therefore, no search occurs when police officers enter those areas. Because the complaint alleged only that police officers entered the public areas of the Galleria Motel, Patel has failed to demonstrate a reasonable expectation of privacy pursuant to Katz, rendering Camara and See inapplicable to this case.

This affirms the lower court's judgment.

The only allegation in the complaint (relevant to this appeal) was Patel's claim that the officers violated the Fourth Amendment. Defendants filed a motion to dismiss for failure to state a claim. The district court granted the motion, holding that neither Patel nor HFS had a reasonable expectation of privacy in the areas of the Galleria Motel that were open to the public.

So, for consistency's sake, if nothing else, cops can't claim to have an expectation of privacy in areas of businesses open to the public, not if the courts are going to deny the same privilege to citizens. But that's exactly what the police union's filing on behalf of the dispensary-raiding cops is trying to achieve.

And, indeed, the judge presiding over the case in Orange County Superior Court has already denied the officers' request for an injunction, stating very briefly that the cops had no expectation of privacy because they were on duty at the time -- never mind everything else about cameras, California's wiretap law (which was invoked by the union) or the public areas of private businesses.

The union is still free to pursue its lawsuit against the police department, but it won't be able to prevent the recordings from being used to investigate the participants of the raid. It will almost certainly appeal this decision, but there's nowhere to go with this particular argument. Even if it makes its way up the chain to the federal appeals court, the Ninth has already expressed its opinion on the privacy expectations of public places... and it used Supreme Court decisions to back its assertions up.

But police unions and badly-behaving police officers are both known to explore every argument available, no matter how incredibly stupid, simply because to do otherwise is to admit wrongdoing. And there's always a chance a system designed to cut cops as much slack as possible will still somehow come through for them.

Filed Under: expectation of privacy, marijuana dispensary, police, privacy, raid

Summer Of The 4th Amendment: Appeals Court Says Mobile Phone Location Is Protected Under 4th Amendment

from the secure-in-their-persons,-houses,-papers,-and-effects dept

It appears that the 4th Amendment is up for a bit of a revival this summer. Last week, we wrote about an important ruling in a Northern California district court saying that mobile phone location info -- officially known as "Cell Site Location Info" or "CSLI" -- was protected by the 4th Amendment, meaning the government couldn't scoop it up without a warrant. The ruling was excellent and detailed, but we noted there would be inevitable appeals.

Now, in a similar case that had already been decided the other way, the 4th Circuit appeals court has overturned that ruling and agreed that mobile phone location info requires a warrant. This is another big victory for the 4th Amendment.

Appellants Aaron Graham and Eric Jordan appeal their convictions for several offenses arising from a series of armed robberies. Specifically, Appellants challenge the district court’s admission of testimonial and documentary evidence relating to cell site location information (“CSLI”) recorded by their cell phone service provider. We conclude that the government’s warrantless procurement of the CSLI was an unreasonable search in violation of Appellants’ Fourth Amendment rights.

Unfortunately, the court says that it doesn't matter in this case because of the "good faith" exception. We've discussed in the past the problems of the "good faith exception," which basically says it's okay to violate the 4th Amendment so long as law enforcement doesn't know it's violating the 4th Amendment. From a basic rights perspective, that seems ridiculous. But, at the very least, this ruling still should make it clear that going forward a warrant is necessary.

The appeals court ruling goes pretty much along the lines you'd expect, pointing out that there's an expectation of privacy in the CSLI and therefore a warrant is needed. It rejects the government's assertion that Sprint/Nextel's privacy policy was agreed to by the defendants and thus waived any privacy expectation.

As an initial matter, we are not persuaded that, as the district court stated, Sprint/Nextel’s privacy policy disproves Appellants’ claim that they had an actual expectation in the privacy of their location and movements. The privacy policy in effect at the time Sprint/Nextel disclosed CSLI to the government stated as follows:

Information we collect when we provide you with Services includes when your wireless device is turned on, how your device is functioning, device signal strength, where it is located, what device you are using, what you have purchased with your device, how you are using it, and what sites you visit.

... First, the policy only states that Sprint/Nextel collects information about the phone’s location – not that it discloses this information to the government or anyone else.

Second, studies have shown that users of electronic communications services often do not read or understand their providers’ privacy policies.3 There is no evidence that Appellants here read or understood the Sprint/Nextel policy.

The court relies on a series of relatively recent Supreme Court decisions to make it clear that the 4th Amendment applies in this case:

Taken together, Karo, Kyllo, and the views expressed in Riley and the Jones concurrences support our conclusion that the government invades a reasonable expectation of privacy when it relies upon technology not in general use to discover the movements of an individual over an extended period of time. Cell phone tracking through inspection of CSLI is one such technology. It is possible that the CSLI for a particular cell phone is not very revealing at all because, for instance, the phone has been turned off or it has made few or no connections to the cellular network. But the government cannot know in advance of obtaining this information how revealing it will be or whether it will detail the cell phone user’s movements in private spaces.... We hold, therefore, that the government engages in a Fourth Amendment search when it seeks to examine historical CSLI pertaining to an extended time period like 14 or 221 days.

It's a good ruling and it looks like the courts are building up a series of rulings on this issue that will inevitably reach the Supreme Court in the near future...

Filed Under: 4th amendment, 4th circuit, csli, expectation of privacy, location info, mobile phones