Supreme Court Turns Down Opportunity To Straighten Out Cell Site Location Information Mess

from the Third-Party-Doctrine-still-mostly-intact dept

Appeals court rulings on the cell site location information are literally all over the place. (Also figuratively.)

What there isn't is any agreement on whether a warrant should be required to obtain this information. Some courts have come to the conclusion that this information -- broadcast by anyone with a cell phone, whether they realize it or not -- falls under the Third Party Doctrine. Others feel historical data is obtainable without warrants but real-time tracking requires additional paperwork.

The Third Party Doctrine is in play in the US v. Davis case. The 11th Circuit Court of Appeals reached the conclusion that there is no expectation of privacy in data collected by third parties (under the questionable assumption that cell site location info is given up "voluntarily" by cell phone users). The defendant, Quartavious Davis, appealed the appeals court's en banc decision.

Had the Supreme Court picked this up, we might have been looking at a final decision on warrants and cell site location data in the near future. The Supreme Court's Riley decision suggests there's an inherent expectation of privacy in the contents of a cell phone. It's not much of a stretch to believe the Supreme Court might find this expectation carries over to the massive amount of information generated by today's cell phones, despite the final storage location of the auto-generated location data.

Unfortunately, it could now be years before we see this resolved. The Supreme Court has decided to pass on Davis's appeal.

The nine justices turned away an appeal filed by a Florida man named Quartavious Davis, who was convicted of participating in a string of 2010 robberies in the Miami area and was sentenced to 1,941 months, almost 162 years, in prison without possibility of parole.

Davis challenged his convictions in part on the grounds that police did not seek a warrant when they asked his cellphone provider, MetroPCS Communications Inc, for location information that linked him to the seven different crime scenes between August and October 2010.

The likelihood remains that the Supreme Court will have to address this issue in the near future. There are simply too many contradictory opinions among the appeals courts to leave this undecided for much longer. Cases challenging the warrantless seizure of cell location data have been plentiful. And the nation's courts seem more aware of law enforcement's manipulation of outdated statutes and court decisions to dodge warrant requirements.

As has been noted by the Supreme Court itself, the Fourth Amendment is purposefully designed to make law enforcement's job more difficult. It's a check against abuse, not an inconvenience to be routed around whenever possible.

Filed Under: 4th amendment, cell site location info, quartavious davis, supreme court, warrant

Appeals Court Says Warrantless Phone Tracking Doesn't Violate 4th Amendment Because 'Third Party Doctrine'

from the oh-boy dept

For about a year now, we've been following the Quartavious Davis en banc appeal case, in which Davis's lawyers were challenging the use of historical cell phone location data (not real time GPS info) that was collected without a warrant in order to convict him (technically, they used a 2703(d) order, which is a much lower standard than a warrant, which requires probable cause, rather than "specific and articulable facts that there are reasonable grounds" to believe that the info is "relevant and material to an ongoing criminal investigation"). Given the renewed interest of the Supreme Court (and other courts) in issues related to the 4th Amendment when it meets up with modern technology, this case got a lot of attention in the last few months. The 11th Circuit has now ruled and it isn't going to make 4th Amendment supporters happy. The court ruled that warrantless tracking of your mobile phone location is not an "illegal search" under the 4th Amendment... because of the old (and ridiculous) third party doctrine.

In case you've been living under a rock and not following such things, the third party doctrine basically says you have no expectation of privacy in data that third parties hold on you -- such as... phone records. This doctrine has a lot of problems (going all the way back to the Smith v. Maryland case that is generally cited in support of the doctrine). But, here, the court just runs with it. It spends a few pages restating the ruling in Smith v. Maryland, clearly agreeing with it, and then it drops the hammer:

For starters, like the bank customer in Miller and the phone customer in Smith, Davis can assert neither ownership nor possession of the third-party’s business records he sought to suppress. Instead, those cell tower records were created by MetroPCS, stored on its own premises, and subject to its control. Cell tower location records do not contain private communications of the subscriber. This type of non-content evidence, lawfully created by a third-party telephone company for legitimate business purposes, does not belong to Davis, even if it concerns him. Like the security camera surveillance images introduced into evidence at his trial, MetroPCS’s cell tower records were not Davis’s to withhold....

More importantly, like the bank customer in Miller and the phone customer in Smith, Davis has no subjective or objective reasonable expectation of privacy in MetroPCS’s business records showing the cell tower locations that wirelessly connected his calls at or near the time of six of the seven robberies.

It dives in a bit deeper on the "expectation of privacy" question and says that no one should have any expectation of privacy in their cell location data, basically saying that you should know that you're giving up such info to a third party who can give it to law enforcement:

We find no reason to conclude that cell phone users lack facts about the functions of cell towers or about telephone providers’ recording cell tower usage.

Thus, no "expectation" of privacy.

It also argues this is no different than the ruling in Smith v. Maryland, because, back then, just having the phone numbers (what that case was about) was the equivalent of also showing location, since in that pre-mobile phone era, a phone number also automatically revealed location since it was tied to an address. As for the public policy reasons why this result is pretty scary concerning the public's privacy, the court says, "Hey, take it up with Congress."

The court also distinguishes this case from the Supreme Court's ruling in US v. Jones from a few years ago, that said that attaching a GPS device to a car could violate the 4th Amendment due to it being a "trespass" (though on the side, some Justices raised concerns about the ongoing collection of location data). Basically the court here said it doesn't matter here, as there's no similar "trespass" situation with the MetroPCS data.

Two of the judges on the panel dissented, and pointed out just how crazy the third party doctrine is in this situation, and how it basically destroys the 4th Amendment:

We are asked to decide whether the government’s actions violated Mr. Davis’s Fourth Amendment rights. The majority says our analysis is dictated by the third-party doctrine, a rule the Supreme Court developed almost forty years ago in the context of bank records and telephone numbers. But such an expansive application of the third-party doctrine would allow the government warrantless access not only to where we are at any given time, but also to whom we send e-mails, our search-engine histories, our online dating and shopping records, and by logical extension, our entire online personas.

In short, those two judges rightly recognize just how problematic the third party doctrine is. In an age where all our info goes to third parties, the 4th Amendment basically goes away. Later, that same dissent notes:

The majority’s blunt application of the third party doctrine threatens to allow the government access to a staggering amount of information that surely must be protected under the Fourth Amendment. Consider the information that Google gets from users of its e-mail and online search functions. According to its website, Google collects information about you (name, e-mail address, telephone number, and credit card data); the things you do online (what videos you watch, what websites you access, and how you view and interact with advertisements); the devices you use (which particular phone or computer you are searching on); and your actual location.... Like in Miller and Smith, Google even offers a legitimate business purpose for such data storage and mining: “Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection.” Id. Under a plain reading of the majority’s rule, by allowing a third-party company access to our e-mail accounts, the websites we visit, and our search-engine history—all for legitimate business purposes—we give up any privacy interest in that information.

And why stop there? Nearly every website collects information about what we do when we visit. So now, under the majority’s rule, the Fourth Amendment allows the government to know from YouTube.com what we watch, or Facebook.com what we post or whom we “friend,” or Amazon.com what we buy, or Wikipedia.com what we research, or Match.com whom we date—all without a warrant. In fact, the government could ask “cloud”-based file-sharing services like Dropbox or Apple’s iCloud for all the files we relinquish to their servers. I am convinced that most internet users would be shocked by this. But as far as I can tell, every argument the government makes in its brief regarding cell site location data applies equally well to e-mail accounts, search-engine histories, shopping-site purchases, cloud-storage files, and the like.

Either way, it's pretty clear this issue is heading to the Supreme Court sooner or later (even possibly with this very case). But, for today, this ruling is a pretty big hit against your privacy.

Filed Under: 4th amendment, expectation of privacy, privacy, quartavious davis, sca, smith v. maryland, stored communications act, third party doctrine, warrants

DOJ Leans On Old Laws And Even Older Cases To Argue Against Privacy Expectations In Cell Site Location Data

from the it's-1979-all-over-again! dept

Last month, AT&T entered an amicus brief in the US v. Quartavious Davis case, arguing that law enforcement shouldn't be allowed warrantless access to cell site location data. AT&T's entry into the privacy battle comes after a lengthy silence during which it was very obliging of government requests for customers' data. The crux of its argument was this:

Nothing in those [prior court] decisions contemplated, much less required, a legal regime that forces individuals to choose between maintaining their privacy and participating in the emerging social, political, and economic world facilitated by the use of today's mobile devices or other location-based services."

That's where we are, as far as private citizens are concerned. The government, through its thorough exploitation of the Third Party Doctrine, has basically forced the public to choose between allowing warrantless access to tons of their data (and metadata) or living some sort of off-the-grid lifestyle that doesn't involve generating "business records" via cell phone, internet service, etc.

Some judges and justices have noted that today's connected world would be completely unrecognizable to the judges who made the decisions the government relies so heavily on: namely, Smith vs. Maryland (1979).

The DOJ has entered its brief [pdf link] for the Eleventh Circuit Court's en banc re-hearing of US vs. Davis (2014), and it again attacks the defendant's assertion that he has an expectation of privacy in his cell phone records. While the government does make a good point that it's difficult for Davis to claim privacy expectations in a phone he refused to admit was his, it goes on to attack the premise that anyone has any expectation of privacy in their cell phone records. (All emphasis the DOJ's.)

Davis may not make out a right to be secure in someone else’s “papers,” see U.S. Const. amend. IV, by complaining that those papers contained “his location data.” Evidence lawfully in the possession of a third party is not his, even if it has to do with him. Indeed, so far as the Fourth Amendment is concerned, Davis could not have prevented MetroPCS from producing the records in question even if they were his.

Here, the government argues that the records you generate by using a cell phone are not yours, nor will they ever be. They belong solely to the company that retains them and, as such, can be obtained with a minimum of paperwork or effort. It expands a bit on this argument a little later in the brief, but the underlying assertion is clear. These records are yours in the fact that they can identify you, but they are not yours should you seek to control access to them.

Certainly Davis could not have prevented the provider from turning over the records, but that skirts some of the issues with this case. AT&T argued that the information it collected was sensitive enough that it should require a warrant to obtain. The government could still obtain these records (as it argues here), but it would need to reach the slightly-higher bar of "probable cause," rather than a court order or a subpoena.

The government leans on the nearly 40-year-old Smith decision as a prelude to its longer dismissal of any additional privacy expectations.

In general, courts have held that phone customers could not have maintained an actual expectation of privacy in routing-related business records made by a phone company to document transactions to which it was a party. See Smith, 442 U.S. at 741-43, 99 S.Ct. at 2580-82; United States v. Gallo, 123 F.2d 229, 231 (2d Cir. 1941). There is no cause to take a different view as to cell tower records.

The DOJ may say that cell phone records are pretty much the same as they've always been, but the dates of the cases cited don't bear this out. One decision is 35 years old. The other is 73 years old. Phone records used to be limited to phone numbers only. Now, they carry additional data, including location -- something that definitely wasn't on the courts' radar 40-70 years ago.

The DOJ then nails the point home, indicting US citizens as complicit in the removal of privacy expectations.

At any rate, Davis is not in a good position to complain that the government improperly obtained “his location data,” since he himself exposed and revealed to MetroPCS the very information he now seeks to keep private—i.e., the general vicinity information circumstantially inferable from cell tower records

"Exposed" and "revealed" are pretty harsh terms for something citizens are forced to give up in order to use cell phones. Without a doubt, many would like to keep this information private, but are unable to do so because even though they generate the records, they ultimately have no control over their distribution. Not only that, but they have considerably less access to records they've generated than law enforcement agencies do. The Third Party Doctrine has managed to turn the American public into handy little data generators -- data that the government can avail itself of with nothing more than a subpoena.

The government further asserts that Davis' stated "ignorance" of the fact that cell providers collect and store location data gives him no reason to claim an expectation of privacy. And this is true. Ignorance isn't a worthwhile excuse. But many of us do know providers store this information and yet, there's nothing that can be done about it other than to forgo the use of a cell phone altogether. That's almost an impossibility in this world, but the government maintains the stance that all of this is optional -- that we willingly create a wealth of data for third parties that can be accessed by law enforcement with minimal paperwork, let alone oversight. These are records we have no control over and yet the government is willing to use these against us while pretending we somehow have a choice in the matter.

Notably, the government also leans heavily on the Stored Communications Act to bolster its arguments -- a 30-year-old law that still treats email over 180 days old as not worthy of a warrant. Again, times have changed but applicable decisions and laws haven't. As it stands now, your life -- as stored by third parties -- is an open book.

This isn't a great test case for privacy expectations in cell phone records. Davis refused to admit ownership of the phone linking him to the string of robberies, taking a lot of the wind out of his Fourth Amendment sails in the progress. Like the Dread Pirate Roberts/Silk Road case, the government has used the denial of ownership to undercut Fourth Amendment concerns (Ulbricht has denied the servers infiltrated by the FBI are his). Defendants are basically being put in the position of incriminating themselves or abandoning any privacy arguments -- an unenviable position.

But the fact remains that location data can reveal far more about a person than the government is willing to admit. It's not simply a "business record." It's a roadmap to a person's connected existence. There should be an expectation of privacy, especially when the data gathered covers a span of days or weeks. But so far, the laws and the courts back up the government's third party assertions.

Filed Under: doj, location data, privacy, quartavious davis, smith v. maryland, third party doctrine, warrantless information
Companies: at&t

AT&T Challenges Government's Warrantless Acquisition Of Cell Site Location Data

from the no-longer-BFFs,-apparently dept

AT&T, of all companies, has just handed in an amicus brief challenging the warrantless acquisition of cell site location data. At the center of this discussion is Quartavious Davis, who was sentenced to 162 years in prison for his involvement in a string of seven robberies, and his cell location records -- 67 days-worth which were obtained by investigators without a warrant.

An earlier appeals court ruling found that cell location records are sensitive enough to be afforded Fourth Amendment protection. The government sought a rehearing and so there's now an en banc rehearing of the case before the full slate of judges from the 11th Circuit Court of Appeals.

AT&T has normally been very cooperative with law enforcement and national security agencies. This filing may look like a shift in loyalties, but what AT&T is asking for isn't exactly revolutionary, or even in line with the panel's previous decision regarding cell site location records.

AT&T said in its filing that it wants the courts to set a clear standard for the type of approval the government needs in order to obtain cellphone location data, and that it isn't taking a position on whether the standard should be a warrant.

While this lack of solid stance may be only minimally encouraging, AT&T's challenge of the government's Third Party Doctrine rationale is a bit more weighty.

AT&T, in a friend-of-the-court brief filed Monday in an appeals-court case, said the high court's reasoning applies poorly "to how individuals interact with one another and with information using modern digital devices."

"Nothing in those [prior court] decisions contemplated, much less required, a legal regime that forces individuals to choose between maintaining their privacy and participating in the emerging social, political, and economic world facilitated by the use of today's mobile devices or other location-based services," the company said.

This echoes the arguments presented by a few federal judges. While the government clings to the Third Party Doctrine and the assertion that the public "voluntarily" turns over this data, the courts have noted that the dynamic has changed. Cellphones are utilitarian at this point, and not some sort of purely voluntary luxury the public can do without. And what the public very certainly isn't doing is creating a wealth of information for law enforcement and investigative agencies to access without a warrant.

What is most unusual about this situation is that AT&T has stepped up to oppose the government's overreach, something it has generally remained largely silent on to this point. This about-face carries with it an air of resentment -- the slightly vindictive act of a company that spent years greasing the government's investigative wheels and got nothing in return but more demands and less respect and trust from the public it hopes to sell products and services to.

Filed Under: cell site, doj, location info, quartavious davis, warrant
Companies: at&t