Federal Court Says Warrants Are Needed To Grab GPS Data From Third-Party Tracking Services

from the seems-like-an-obvious-extension-of-Carpenter dept

In 2012, the Supreme Court decided that GPS tracking devices require warrants. Notably, this wasn't because the GPS data was deserving of Fourth Amendment protections but because officers had to trespass on private property (a car parked in a driveway) to attach the device.

That left law enforcement with a lot a gray area in which to operate. Since there was no distinct finding that GPS data was protected, it could theoretically be harvested from third-party devices without a warrant. The Supreme Court's decision in the Carpenter case, however, appeared to extend protections to the records themselves. It declared the acquisition of cell site location info requires the use of the warrant, extending Fourth Amendment protections to third party records of people's movements. It could be argued this decision covers GPS data pulled from third party services, since it's basically the same thing: gathering records of a person's movements.

In a recent federal case [PDF], both of these Supreme Court decisions are in play. It appears law enforcement thought it had found a way to route around the Jones decision. Investigating a robbery, detectives approached the dealership that had sold the vehicle spotted at the scene of the crime. The dealership had installed a tracking device to make the car easier to find in case of a repo. This was the data detectives obtained without a warrant.

On March 29, 2017, Hinsdale detectives issued an alert “on multiple databases” seeking information about the Lexus. Id. at 3. On April 4, 2017, a Headers employee told one of the detectives that the Lexus was equipped with a GPS tracking device serviced by Air Assault Asset Track GPS Systems. The Headers employee gave the detective her login credentials for Air Assault’s website and authorized him to access “all the GPS records associated with the Devinn Adams/Lexus RX account.” The GPS records included historical data tracking the Lexus’s “movement and global position.”

Without first obtaining a warrant, the detective downloaded a spreadsheet containing GPS data for the period from March 1, 2017 through April 4, 2017. The spreadsheet sets forth time-stamped entries giving the Lexus’s approximate street address (usually at the block level, such as “5701-5799 S Campbell Ave, Chicago, IL, 60629”) each time it was turned on, approximately every five minutes while it was being driven, and each time it was parked. According to the detective, “[g]reater detail” beyond those approximate street addresses “c[ould] be extracted from the map points” using “the software program that manages the GPS data,” which allowed the detective to “narrow[]” each recorded location “to specific latitude and longitude way points.”

Tobias Diggs, the alleged driver, moved to suppress the evidence, stating that both the Jones and Carpenter decisions prohibited this information being obtained without a warrant. The government argued that neither decision mattered.

The government responds that acquiring the data was not a Fourth Amendment search because: (1) unlike in Jones, the police made no physical intrusion on the Lexus, Doc. 55 at 10-12; and (2) under the third-party doctrine, Diggs lacked a reasonable expectation of privacy in the data because he voluntarily provided it to the third party (Headers) from which the police obtained it, id. at 5-10.

Wrong, says the court. This is exactly what's covered by these two decisions.

The GPS data at issue here fits squarely within the scope of the reasonable expectation of privacy identified by the Jones concurrences and reaffirmed in Carpenter. The GPS data provide “a precise, comprehensive record of [Diggs’s] public movements” over the course of a month.

It goes on to point out the data collected here is pretty much indistinguishable from the data at the heart of the Carpenter decision.

Applying the third-party doctrine to the GPS data here would require essentially the same extension of the doctrine that the Court rejected in Carpenter. Carpenter understood CSLI to present “many of the qualities of the GPS monitoring … considered in Jones”—both are “detailed, encyclopedic, and effortlessly compiled”; both “provide[] an intimate window into a person’s life”; and, in the context of historical information, both provide a “tracking capacity [that] runs against everyone” without any need for the police to “know in advance whether they want to follow a particular individual, or when.” Indeed, at the time of the search in Carpenter, CSLI was still “less precise than GPS information.” Accordingly, Carpenter compels the conclusion that, given the privacy concerns implicated by the “detailed and comprehensive record of [Diggs’s] movements” captured by the Lexus’s GPS tracker, “the fact that the [police] obtained the information from a third party does not overcome [Diggs’s] claim to Fourth Amendment protection.”

The government also tried to get the good faith exception applied. Given that this search occurred prior to the Carpenter decision, the government says the detectives had no reason to believe a warrant was needed. The court disagrees. The government can point to no prior cases specifically authorizing this sort of warrantless search. But more importantly, it reiterates that the Carpenter decision can -- and should -- be applied retroactively.

The Supreme Court could have described what it was doing in Carpenter, not as declining to extend the third-party doctrine to a context not addressed in Smith and Miller, but as partially scaling back the once-categorical doctrine to account for “the seismic shifts in digital technology” that gave rise to widespread, long-term location tracking. 138 S. Ct. at 2219. Had it done so, the Davis good-faith exception might very well have applied here. [...] But instead, the Court said that the third-party doctrine was never broad enough to encompass technology-enabled long-term location tracking in the first place.

[...]

Carpenter thus teaches that general statements of the third-party doctrine uttered in pre-Carpenter decisions not only do not cover CSLI, but never did. And as noted above, what Carpenter said about the third-party doctrine as to CSLI applies with full force to GPS data. It follows that for the Davis good-faith exception to apply to the GPS search here, the government needs more than general statements of the third-party doctrine in a binding appellate decision issued before the search; rather, the government must point to binding appellate precedent applying the doctrine to long-term historical GPS data or its equivalent.

The government loses the GPS data evidence. And it may lose even more than that if any of its other evidence was derived from this unlawful acquisition of data, which possibly includes DNA samples and social media records.

Not every court has read the Carpenter decision as retroactive, but this court's opinion makes really good points about why it should be read that way in all instances. The Third Party Doctrine was altered significantly by this decision, even if it only dealt with cell site location info. It has changed the contours of what can be considered a "reasonable" search of records held by third parties. Location info is only the beginning. The court's extension of this protection to third-party GPS records sends a message to law enforcement that the stuff they did for the last 40 years (thanks to Smith v. Maryland) may no longer survive a suppression challenge.

Filed Under: 4th amendment, carpenter, gps, jones, supreme court, third party doctrine, warrants

Score One For The 4th Amendment: Appeals Court Says Police Need A Warrant To Track Phone Users' Location

from the big-win dept

A very big and important ruling came out yesterday in the 11th Circuit appeals court, saying that police need to get a warrant to track someone's location (via their mobile phone locations). This is a big deal, as we've been discussing for years. Many state courts have issued similar rulings, but many federal courts had gone the other way. While a few district courts had agreed that a warrant was needed, having an appeals court say so is a big deal.

In this case, the defendant, Quartavius Davis, was accused of a bunch of crimes, involving robbing a bunch of stores. Among the variety of evidence against him was cell phone location data -- specifically 11,606 location records. Davis argued that the data was collected without a warrant, violating his 4th Amendment rights (he also has other issues with the way the case was handled and challenges some other aspects as well, but we'll focus on the 4th Amendment issue concerning his location data). The court notes that other courts are still struggling with this issue, and looks to the Supreme Court's famous ruling in the Jones case, involving whether or not a warrant is needed to attach a GPS device to a car. As we noted then, that ruling stopped short of really examining if gathering up location data required a warrant, though some of the side opinions (mainly the concurrence by Justice Sotomayor) discussed the idea. This ruling looks back at some history around the 4th Amendment, and the evolving view concerning "trespass theory" vs "privacy theory," before digging into Jones. The Jones case, you may recall, was decided on the idea that putting the device on the car was a form of "trespass," leaving aside the privacy aspect. But, obviously, this case is different. Thankfully, the court takes some instruction from the concurrences that do discuss privacy theory, and see how they apply in this case.

But, in an important way, the court seems to go even further. While much of the focus in the Jones case was on the "mosaic theory" of linking together a bunch of individual location data points to create a picture that reveals something people expected to be kept private, this ruling notes that even a single data point may be enough to violate the expectation of privacy:

One’s cell phone, unlike an automobile, can accompany its owner anywhere. Thus, the exposure of the cell site location information can convert what would otherwise be a private event into a public one. When one’s whereabouts are not public, then one may have a reasonable expectation of privacy in those whereabouts. Therefore, while it may be the case that even in light of the Jones opinion, GPS location information on an automobile would be protected only in the case of aggregated data, even one point of cell site location data can be within a reasonable expectation of privacy. In that sense, cell site data is more like communications data than it is like GPS information. That is, it is private in nature rather than being public data that warrants privacy protection only when its collection creates a sufficient mosaic to expose that which would otherwise be private.

The court also rejects the idea that the information is not private just because it puts the defendant near the scene of a crime:

The prosecutor at trial stressed how the cell phone use of the defendant established that he was near each of six crime scenes. While committing a crime is certainly not within a legitimate expectation of privacy, if the cell site location data could place him near those scenes, it could place him near any other scene. There is a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship, or a house of ill repute. Again, we do not see the factual distinction as taking Davis’s location outside his expectation of privacy. That information obtained by an invasion of privacy may not be entirely precise does not change the calculus as to whether obtaining it was in fact an invasion of privacy.

And, finally, the court addresses the famed "third party doctrine" issue, of whether or not Davis gave up his right to privacy to this information because it's been "given" to a third party (i.e., the mobile phone operators). The court is not convinced and (thankfully) explains how Smith v. Maryland (that key case that so many third party doctrine claims rely on) doesn't make sense here, relying on a ruling from the 3rd Circuit, stating that because Davis did not "voluntarily" shared this information with the mobile operator, the third party doctrine does not apply (amusingly, the court even cites the government's own arguments to support the lack of a voluntary handover):

The reasoning in Smith depended on the proposition that “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties,” .... The Third Circuit went on to observe that “a cell phone customer has not ‘voluntarily’ shared his location information with a cellular provider in any meaningful way.” That circuit further noted that “it is unlikely that cell phone customers are aware that their cell phone providers collect and store historical location information.” ... (emphasis added). Therefore, as the Third Circuit concluded, “when a cell phone user makes a call, the only information that is voluntarily and knowingly conveyed to the phone company is the number that is dialed, and there is no indication to the user that making that call will also locate the caller.” ... Even more persuasively, “when a cell phone user receives a call, he hasn’t voluntarily exposed anything at all.” ....

Supportive of this proposition is the argument made by the United States to the jury. The prosecutor stated to the jury “that obviously Willie Smith, like [Davis], probably had no idea that by bringing their cell phones with them to these robberies, they were allowing [their cell service provider] and now all of you to follow their movements on the days and at the times of the robberies . . . .” Just so. Davis has not voluntarily disclosed his cell site location information to the provider in such a fashion as to lose his reasonable expectation of privacy. In short, we hold that cell site location information is within the subscriber’s reasonable expectation of privacy. The obtaining of that data without a warrant is a Fourth Amendment violation.

That said, the court still decides to not overturn the original ruling, saying that the court ruled in good faith. However, it still means that future cases will require a warrant for this information (within areas covered by the 11th Circuit). It seems likely that this, or another similar case in a different circuit, will eventually make it to the Supreme Court, but this is a very good ruling in the meantime.

Filed Under: 11th circuit, 4th amendment, cell site location data, gps, jones, location data, mosaic theory, privacy, quartavius davis, third party doctrine, warrant