Federal Judge Says Third Party Doctrine A Perfectly 'Good Law;' No Warrants Needed To Obtain Cell Location Records

from the multiple-government-agencies-agree! dept

Back in December, a Connecticut state court ruled that tracking people in near-real time with cell site location info required the use of a warrant. Three months later, a Connecticut federal court has ruled law enforcement can obtain CSLI without a warrant, in bulk and for extended periods of time. While the opinion doesn't address the use of subpoenas and CSLI as a makeshift Stingray (for real-time tracking), it does come down firmly on the side of the government's interpretation of the Third Party Doctrine.

Here, the Government acquired information about defendant that was in the possession of a third-party—Verizon—and that the acquisition of this information did not involve any trespass upon defendant’s body, house, papers, or effects and did not involve any interference at all with defendant’s possessory interests in any of his property.

The opinion leans heavily on every decision finding that there's no expectation of privacy in records held by third parties. The court makes the slightest nod to the current discussion of expectations of privacy in a world where the devices most people carry generate a wealth of information and data nearly non-stop. But it does so with wording that shows it has no interest in engaging in this discussion.

The third-party doctrine has been subject to tsunamis of criticism. But it doubtlessly remains good law today.

And, like other decisions along the same lines, the court echoes the government's assertions that every cell phone user is perfectly aware their phones are sending all sorts of information to the nearest cell tower.

Defendant also contends that cell-site location information is not voluntarily conveyed to one’s cellular telephone company in the same sense or manner that one voluntarily conveys financial information to a bank as in Miller or telephone numbers to a telephone company as in Smith. Although this rationale has convinced some courts to conclude that the third-party doctrine does not apply, I do not agree. Every cell phone customer knows that his or her information is relayed wirelessly to nearby cell phone towers. It can come as no surprise that one’s cell phone company keeps records of cell towers that are accessed by and necessary to the provision and connection of every customer’s cell phone service. This is no different than every customer’s awareness that the bank keeps records of one’s checks and transactions (Miller) and that the telephone company keeps records of the telephone numbers that one calls (Smith).

The court also points out there's no bright line determination as to how much is too much when it comes to acquiring location records. (The defendant raised the argument that 22 days of CSLI was excessive without the use of a warrant.) As the court logically points out, any determination on an acceptable time frame would be completely arbitrary and mostly useless.

As for the Third Party Doctrine's possible inapplicability in today's world, the court says that's up to Congress to fix, not the courts.

All that said, the critics of the third-party doctrine have strong arguments it does not adequately protect privacy—that it imposes an unacceptable and Orwellian cost of forfeiture of any claim of privacy to what we voluntarily disclose even in confidence to one another. The critics persuasively argue that the doctrine is especially problematic in our ever expanding technology-dependent and technology-intrusive society. But these are arguments for policymakers in Congress to consider, if Congress wishes to enact protections that exceed the Fourth Amendment baseline.

[...]

In the meantime, the obligation remains for the lower courts to follow the law and not to impose—no matter how techno-intellectually fashionable—an “everything is different because it’s an iPhone” theory of the Fourth Amendment.

The issue of real-time warrantless tracking remains unaddressed as this case only dealt with historic data. The question of the Third Party Doctrine is punted back to Congress -- which has proven mostly uninterested in updating outdated laws to better conform to today's reality. Even with a boot up the ladder to a higher court is unlikely to result in a re-reading of the Third Party Doctrine. The Supreme Court has only determined that long-term location tracking might need a warrant. As it stands now, the acquisition of third-party records violates no one's privacy, legally-speaking.

Filed Under: 4th amendment, cell site location info, connecticut, csli, mosaic theory, privacy, third party doctrine

Score One For The 4th Amendment: Appeals Court Says Police Need A Warrant To Track Phone Users' Location

from the big-win dept

A very big and important ruling came out yesterday in the 11th Circuit appeals court, saying that police need to get a warrant to track someone's location (via their mobile phone locations). This is a big deal, as we've been discussing for years. Many state courts have issued similar rulings, but many federal courts had gone the other way. While a few district courts had agreed that a warrant was needed, having an appeals court say so is a big deal.

In this case, the defendant, Quartavius Davis, was accused of a bunch of crimes, involving robbing a bunch of stores. Among the variety of evidence against him was cell phone location data -- specifically 11,606 location records. Davis argued that the data was collected without a warrant, violating his 4th Amendment rights (he also has other issues with the way the case was handled and challenges some other aspects as well, but we'll focus on the 4th Amendment issue concerning his location data). The court notes that other courts are still struggling with this issue, and looks to the Supreme Court's famous ruling in the Jones case, involving whether or not a warrant is needed to attach a GPS device to a car. As we noted then, that ruling stopped short of really examining if gathering up location data required a warrant, though some of the side opinions (mainly the concurrence by Justice Sotomayor) discussed the idea. This ruling looks back at some history around the 4th Amendment, and the evolving view concerning "trespass theory" vs "privacy theory," before digging into Jones. The Jones case, you may recall, was decided on the idea that putting the device on the car was a form of "trespass," leaving aside the privacy aspect. But, obviously, this case is different. Thankfully, the court takes some instruction from the concurrences that do discuss privacy theory, and see how they apply in this case.

But, in an important way, the court seems to go even further. While much of the focus in the Jones case was on the "mosaic theory" of linking together a bunch of individual location data points to create a picture that reveals something people expected to be kept private, this ruling notes that even a single data point may be enough to violate the expectation of privacy:

One’s cell phone, unlike an automobile, can accompany its owner anywhere. Thus, the exposure of the cell site location information can convert what would otherwise be a private event into a public one. When one’s whereabouts are not public, then one may have a reasonable expectation of privacy in those whereabouts. Therefore, while it may be the case that even in light of the Jones opinion, GPS location information on an automobile would be protected only in the case of aggregated data, even one point of cell site location data can be within a reasonable expectation of privacy. In that sense, cell site data is more like communications data than it is like GPS information. That is, it is private in nature rather than being public data that warrants privacy protection only when its collection creates a sufficient mosaic to expose that which would otherwise be private.

The court also rejects the idea that the information is not private just because it puts the defendant near the scene of a crime:

The prosecutor at trial stressed how the cell phone use of the defendant established that he was near each of six crime scenes. While committing a crime is certainly not within a legitimate expectation of privacy, if the cell site location data could place him near those scenes, it could place him near any other scene. There is a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship, or a house of ill repute. Again, we do not see the factual distinction as taking Davis’s location outside his expectation of privacy. That information obtained by an invasion of privacy may not be entirely precise does not change the calculus as to whether obtaining it was in fact an invasion of privacy.

And, finally, the court addresses the famed "third party doctrine" issue, of whether or not Davis gave up his right to privacy to this information because it's been "given" to a third party (i.e., the mobile phone operators). The court is not convinced and (thankfully) explains how Smith v. Maryland (that key case that so many third party doctrine claims rely on) doesn't make sense here, relying on a ruling from the 3rd Circuit, stating that because Davis did not "voluntarily" shared this information with the mobile operator, the third party doctrine does not apply (amusingly, the court even cites the government's own arguments to support the lack of a voluntary handover):

The reasoning in Smith depended on the proposition that “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties,” .... The Third Circuit went on to observe that “a cell phone customer has not ‘voluntarily’ shared his location information with a cellular provider in any meaningful way.” That circuit further noted that “it is unlikely that cell phone customers are aware that their cell phone providers collect and store historical location information.” ... (emphasis added). Therefore, as the Third Circuit concluded, “when a cell phone user makes a call, the only information that is voluntarily and knowingly conveyed to the phone company is the number that is dialed, and there is no indication to the user that making that call will also locate the caller.” ... Even more persuasively, “when a cell phone user receives a call, he hasn’t voluntarily exposed anything at all.” ....

Supportive of this proposition is the argument made by the United States to the jury. The prosecutor stated to the jury “that obviously Willie Smith, like [Davis], probably had no idea that by bringing their cell phones with them to these robberies, they were allowing [their cell service provider] and now all of you to follow their movements on the days and at the times of the robberies . . . .” Just so. Davis has not voluntarily disclosed his cell site location information to the provider in such a fashion as to lose his reasonable expectation of privacy. In short, we hold that cell site location information is within the subscriber’s reasonable expectation of privacy. The obtaining of that data without a warrant is a Fourth Amendment violation.

That said, the court still decides to not overturn the original ruling, saying that the court ruled in good faith. However, it still means that future cases will require a warrant for this information (within areas covered by the 11th Circuit). It seems likely that this, or another similar case in a different circuit, will eventually make it to the Supreme Court, but this is a very good ruling in the meantime.

Filed Under: 11th circuit, 4th amendment, cell site location data, gps, jones, location data, mosaic theory, privacy, quartavius davis, third party doctrine, warrant

NYPD Decides To Ape FBI's Tactics And Cite The 'Mosaic Theory' As The Reason It Won't Disclose Budget Data

from the NYPD-forces-NYC-to-secede-from-nation,-run-as-martial-state dept

The NYPD apparently feels it's one of the Big Boys. Presiding over a city of 8 million citizens and given free rein to operate outside the confines of the Constitution (while being tirelessly defended by the mayor and police chief) has given the department an outsized sense of self-worth. Now, it's deploying fed-level talking points to further deny access to public records via freedom of information requests.

The New York City Police Department is invoking a concept frequently employed by intelligence agencies like the FBI and CIA to deny a request for financial records on the unit that surveils Muslim communities.

Even to release a budget for the secretive Zone Assessment Unit, the NYPD claimed in a letter to HuffPost, would allow someone to "form a mosaic that depicts covert public safety activities that would be jeopardized."

Observers will note this is the same excuse given by the FBI to turn down perfectly legal FOIA requests from Ryan Shapiro, a former punk rocker turned animal rights activist. Shapiro utilized privacy waivers to make multiple requests for the same documents. Multiple versions of the same documents uncovered anomalies in the redactions, allowing Shapiro to access info that he wouldn't have received with a single request. The FBI's argument was basically that it sucked at consistent censoring, therefore Shapiro shouldn't be allowed to receive any documents as the result of FOIA requests.

As Matt Sledge at the Huffington Post points out, this "mosaic theory" has been deployed by administrations as far back as Reagan's in order to avoid complying with FOIA requests. But this is the first time a local law enforcement agency has used the theory to block access to public documents.

[Bob] Freeman, one of the state's leading authorities on FOIL law, said he has never seen a local law enforcement agency deny a records request on the basis of the mosaic theory. Nor has Jeffrey Light, a lawyer who litigates both federal FOIA lawsuits relating to intelligence agencies and Washington, D.C., police public records requests.

The NYPD also denied HuffPost's requests for information on policies relating to its cooperation with foreign governments under the International Liaison Program, which has placed NYPD officers in a dozen foreign countries to report on terror attacks. The NYPD stated that it had no records of such policies. The department also rejected requests for records on financial support from the New York City Police Foundation and federal agencies like the White House's High Intensity Drug Trafficking Area program. The Associated Press revealed last year that White House funds had been used to pay for Zone Assessment Unit vehicles and computers.

In addition to the mosaic theory, the NYPD also cited a slew of reasons why it couldn't release the records, ranging from the fear that they might reveal confidential sources and information, to ongoing litigation against NYPD spying, to a public records law exemption for intra-agency privilege. It did not cite which exemptions were being applied to which records requests.

The first issue here is the "mosaic theory" itself. The fear that dedicated requesters could piece together classified information by requesting multiple documents is an indictment of the system itself. Routine overclassification has made it impossible for those charged with vetting and releasing requested documents to do their job effectively. The bar for declaring something classified has been set so low that its use is almost entirely subjective. Instead of having verifiable standards that span each agency, every FOIA request is turned over to a variety of fiefdoms. Classified info leaks because there's no standard being applied. Everyone deploys the black marker differently, largely based on self-interest.

The other issue is the NYPD itself, which has been described as worse than the CIA, FBI and NSA when it comes to responding to FOIA requests. The department deploys every tactic possible to refuse requests and that's often following weeks of stonewalling. Just recently, the department went so far as to refuse public access to precinct police blotters, a staple of public information that it has shared without issue for decades. And this latest affront to open government and accountability is over budget documents of all things, and yet the PD claims it will expose methods and operational data.

Freedom of Information laws are specifically in place to thwart government agencies' natural tendency to obscure and obfuscate. The NYPD has never been much for sharing info with the public, dating all the way back to Giuliani's mayoral reign. Under Chief Kelly, the antagonistic attitude towards the public has only increased, along with the NYPD's secretiveness. Now, it's deloying the sort of anti-FOIA rhetoric normally reserved for federal investigative agencies and presidential administrations. New York City may be the largest city in the nation, but this is still a police department -- albeit one that insists on punching above its weight.

Filed Under: fbi, freedom of information, mosaic theory, new york, nypd

FBI Stops Responding To The Most Prolific FOIA Filer, Because He Might Actually Learn Something

from the he's-so-effective-that-they'd-like-him-to-stop dept

Mother Jones has an interesting profile of Ryan Shapiro, a punk rocker turned animal rights activist turned MIT PhD student, who is officially the "most prolific" filer of Freedom of Information Act (FOIA) requests from the FBI. At a high point, he was filing an average of two per day. In fact, he filed so many FOIA requests so successfully, that the FBI is now refusing to respond and is giving the courts a secret explanation which they won't share.

The FBI claims that it cannot discuss the case in open court "without damaging the very national security law enforcement interests it is seeking to protect." Instead, it has filed a secret declaration outlining its case. "This is an especially circular and Kafkaesque line of argument," Shapiro counters. "The FBI considers it a national security threat to make public its reasoning for considering it a national security threat to use federal law to request information about the FBI's deeply problematic understanding of national security threats."

The FBI is basically arguing that because Shapiro is filing so many requests, he might actually be able to pull enough info together from so many different responses, that it would reveal stuff that wouldn't have been revealed if it had been found in a single FOIA request. In other words, Shapiro is better at this game than the FOIA censors, figuring out ways to get a variety of information that, when put together, is actually kind of useful.

Part of the trick, apparently, is getting a ton of people to agree to sign "privacy waivers" so he can request the FBI's info on those people, which the FBI wouldn't reveal otherwise.

When he started using privacy waivers, Shapiro realized he was on to something. Suppose you and I volunteered for the animal rights group PETA. If Shapiro requested all PETA-related FBI documents, he might get something back, but any references to us would be blacked out. If he requested documents related to us, he'd probably get nothing at all. But if he filed his PETA request along with privacy waivers signed by us, the FBI would be compelled to return all PETA documents that mention us—with the relevant details uncensored.

Shapiro began calling up old friends and asking for waivers. Coming of age amid the 1990s punk scene, he'd been drawn to animal rights causes and took part in their actions. He walked into foie gras facilities to film sick and injured ducks, several of which he rescued, and locked himself to the doors of fur salons. And while he no longer does such things, he has kept in touch with people who do.

Armed with signed privacy waivers, he sent out a few experimental requests—he calls them "submarine pings"—and when the FBI returned more than 100 pages on a close friend, he knew he'd struck gold. The response included pages of information that Shapiro had requested previously, but that the FBI had claimed didn't exist. Using case details from those documents and a handful of additional waivers, he filed a new set of requests.

Later in the article, Shapiro admits that as he got more and more responses, it certainly allowed him to fill in many blanks (and also point him to where to file other requests). This, it seems, is exactly what the FBI fears the most: Shapiro has outsmarted them. While, normally, FOIA responses are done in a manner to limit what information is shared and to never, ever suggest a slightly different query that might be useful, it appears Shapiro has more or less figured out a way around that, in part via bulk requests which lead down other paths of inquiry. No wonder the FBI has stopped responding. Shapiro just plays the game better than they do, and they're used to a world where the house always wins.

Filed Under: activists, animal rights, fbi, foia, mosaic theory, privacy waiver, ryan shapiro

Supreme Court Considers Constitutionality Of Having People Tracked By GPS All The Time

from the expectations-of-privacy dept

Last year, we wrote about a (somewhat surprising, given similar rulings elsewhere) ruling by the appeals court for DC, saying that, while law enforcement could use a GPS device to track where you go on a trip, doing long-term, always-on monitoring went beyond the "reasonable expectation" of privacy, and was a 4th Amendment violation. This week, the Supreme Court heard the appeal on that case, and wondered whether or not such 24/7 monitoring was reasonable. The government's argument is simply that when you're traveling in public, it's public, and so there's no expectation of privacy. But, it sounds like the Justices recognize a rather problematic slippery slope developing around this argument:

This argument seemed to alarm several of the justices. "If you win this case then there is nothing to prevent the police or the government from monitoring 24 hours a day the public movement of every citizen of the United States," Justice Breyer said. "And no one, at least very rarely, sends human beings to follow people 24 hours a day. That occasionally happens. But with the machines, you can. So if you win, you suddenly produce what sounds like 1984."

"This case does not involve 24-hour surveillance of every citizen of the United States," Dreeben countered. "It involves following one suspected drug dealer as to whom there was very strong suspicion." But he wasn't able to explain how pervasive surveillance would have to get before it became constitutionally problematic.

Chief Justice Roberts asked if the government's theory would allow the police to install tracking devices on the cars of the members of the Supreme Court. Dreeben said it would. He suggested that legislatures might want to place limits on such surveillance, but argued that it didn't raise any constitutional concerns.

Justice Kennedy asked whether the government's theory would allow the installation of a GPS tracking device on a suspect's overcoat. Again, Dreeben argued that it would, provided that it only report information about the suspect's movements in public places.

I also have to agree with Tim Lee, who wrote the Ars Technica post linked and quoted above, in noting that the lawyer for the guy who was surveilled, Antoine Jones, seemed to focus on a rather weak point in his argument. Rather than focusing on the problem that the appeals court noted -- this "mosaic theory" that the sum total of this 24/7 surveillance violated the 4th Amendment -- Jones' lawyer focused on the question of trespassing in installing the GPS device, something that seems kind of meaningless when you consider that most such tracking can now be done remotely via mobile phones/satellites, without a direct device attached to a car.

Filed Under: 4th amendment, gps, mosaic theory, privacy