Appeals Court Says Warrantless Phone Tracking Doesn't Violate 4th Amendment Because 'Third Party Doctrine'

from the oh-boy dept

For about a year now, we've been following the Quartavious Davis en banc appeal case, in which Davis's lawyers were challenging the use of historical cell phone location data (not real time GPS info) that was collected without a warrant in order to convict him (technically, they used a 2703(d) order, which is a much lower standard than a warrant, which requires probable cause, rather than "specific and articulable facts that there are reasonable grounds" to believe that the info is "relevant and material to an ongoing criminal investigation"). Given the renewed interest of the Supreme Court (and other courts) in issues related to the 4th Amendment when it meets up with modern technology, this case got a lot of attention in the last few months. The 11th Circuit has now ruled and it isn't going to make 4th Amendment supporters happy. The court ruled that warrantless tracking of your mobile phone location is not an "illegal search" under the 4th Amendment... because of the old (and ridiculous) third party doctrine.

In case you've been living under a rock and not following such things, the third party doctrine basically says you have no expectation of privacy in data that third parties hold on you -- such as... phone records. This doctrine has a lot of problems (going all the way back to the Smith v. Maryland case that is generally cited in support of the doctrine). But, here, the court just runs with it. It spends a few pages restating the ruling in Smith v. Maryland, clearly agreeing with it, and then it drops the hammer:

For starters, like the bank customer in Miller and the phone customer in Smith, Davis can assert neither ownership nor possession of the third-party’s business records he sought to suppress. Instead, those cell tower records were created by MetroPCS, stored on its own premises, and subject to its control. Cell tower location records do not contain private communications of the subscriber. This type of non-content evidence, lawfully created by a third-party telephone company for legitimate business purposes, does not belong to Davis, even if it concerns him. Like the security camera surveillance images introduced into evidence at his trial, MetroPCS’s cell tower records were not Davis’s to withhold....

More importantly, like the bank customer in Miller and the phone customer in Smith, Davis has no subjective or objective reasonable expectation of privacy in MetroPCS’s business records showing the cell tower locations that wirelessly connected his calls at or near the time of six of the seven robberies.

It dives in a bit deeper on the "expectation of privacy" question and says that no one should have any expectation of privacy in their cell location data, basically saying that you should know that you're giving up such info to a third party who can give it to law enforcement:

We find no reason to conclude that cell phone users lack facts about the functions of cell towers or about telephone providers’ recording cell tower usage.

Thus, no "expectation" of privacy.

It also argues this is no different than the ruling in Smith v. Maryland, because, back then, just having the phone numbers (what that case was about) was the equivalent of also showing location, since in that pre-mobile phone era, a phone number also automatically revealed location since it was tied to an address. As for the public policy reasons why this result is pretty scary concerning the public's privacy, the court says, "Hey, take it up with Congress."

The court also distinguishes this case from the Supreme Court's ruling in US v. Jones from a few years ago, that said that attaching a GPS device to a car could violate the 4th Amendment due to it being a "trespass" (though on the side, some Justices raised concerns about the ongoing collection of location data). Basically the court here said it doesn't matter here, as there's no similar "trespass" situation with the MetroPCS data.

Two of the judges on the panel dissented, and pointed out just how crazy the third party doctrine is in this situation, and how it basically destroys the 4th Amendment:

We are asked to decide whether the government’s actions violated Mr. Davis’s Fourth Amendment rights. The majority says our analysis is dictated by the third-party doctrine, a rule the Supreme Court developed almost forty years ago in the context of bank records and telephone numbers. But such an expansive application of the third-party doctrine would allow the government warrantless access not only to where we are at any given time, but also to whom we send e-mails, our search-engine histories, our online dating and shopping records, and by logical extension, our entire online personas.

In short, those two judges rightly recognize just how problematic the third party doctrine is. In an age where all our info goes to third parties, the 4th Amendment basically goes away. Later, that same dissent notes:

The majority’s blunt application of the third party doctrine threatens to allow the government access to a staggering amount of information that surely must be protected under the Fourth Amendment. Consider the information that Google gets from users of its e-mail and online search functions. According to its website, Google collects information about you (name, e-mail address, telephone number, and credit card data); the things you do online (what videos you watch, what websites you access, and how you view and interact with advertisements); the devices you use (which particular phone or computer you are searching on); and your actual location.... Like in Miller and Smith, Google even offers a legitimate business purpose for such data storage and mining: “Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection.” Id. Under a plain reading of the majority’s rule, by allowing a third-party company access to our e-mail accounts, the websites we visit, and our search-engine history—all for legitimate business purposes—we give up any privacy interest in that information.

And why stop there? Nearly every website collects information about what we do when we visit. So now, under the majority’s rule, the Fourth Amendment allows the government to know from YouTube.com what we watch, or Facebook.com what we post or whom we “friend,” or Amazon.com what we buy, or Wikipedia.com what we research, or Match.com whom we date—all without a warrant. In fact, the government could ask “cloud”-based file-sharing services like Dropbox or Apple’s iCloud for all the files we relinquish to their servers. I am convinced that most internet users would be shocked by this. But as far as I can tell, every argument the government makes in its brief regarding cell site location data applies equally well to e-mail accounts, search-engine histories, shopping-site purchases, cloud-storage files, and the like.

Either way, it's pretty clear this issue is heading to the Supreme Court sooner or later (even possibly with this very case). But, for today, this ruling is a pretty big hit against your privacy.

Filed Under: 4th amendment, expectation of privacy, privacy, quartavious davis, sca, smith v. maryland, stored communications act, third party doctrine, warrants

DOJ Leans On Old Laws And Even Older Cases To Argue Against Privacy Expectations In Cell Site Location Data

from the it's-1979-all-over-again! dept

Last month, AT&T entered an amicus brief in the US v. Quartavious Davis case, arguing that law enforcement shouldn't be allowed warrantless access to cell site location data. AT&T's entry into the privacy battle comes after a lengthy silence during which it was very obliging of government requests for customers' data. The crux of its argument was this:

Nothing in those [prior court] decisions contemplated, much less required, a legal regime that forces individuals to choose between maintaining their privacy and participating in the emerging social, political, and economic world facilitated by the use of today's mobile devices or other location-based services."

That's where we are, as far as private citizens are concerned. The government, through its thorough exploitation of the Third Party Doctrine, has basically forced the public to choose between allowing warrantless access to tons of their data (and metadata) or living some sort of off-the-grid lifestyle that doesn't involve generating "business records" via cell phone, internet service, etc.

Some judges and justices have noted that today's connected world would be completely unrecognizable to the judges who made the decisions the government relies so heavily on: namely, Smith vs. Maryland (1979).

The DOJ has entered its brief [pdf link] for the Eleventh Circuit Court's en banc re-hearing of US vs. Davis (2014), and it again attacks the defendant's assertion that he has an expectation of privacy in his cell phone records. While the government does make a good point that it's difficult for Davis to claim privacy expectations in a phone he refused to admit was his, it goes on to attack the premise that anyone has any expectation of privacy in their cell phone records. (All emphasis the DOJ's.)

Davis may not make out a right to be secure in someone else’s “papers,” see U.S. Const. amend. IV, by complaining that those papers contained “his location data.” Evidence lawfully in the possession of a third party is not his, even if it has to do with him. Indeed, so far as the Fourth Amendment is concerned, Davis could not have prevented MetroPCS from producing the records in question even if they were his.

Here, the government argues that the records you generate by using a cell phone are not yours, nor will they ever be. They belong solely to the company that retains them and, as such, can be obtained with a minimum of paperwork or effort. It expands a bit on this argument a little later in the brief, but the underlying assertion is clear. These records are yours in the fact that they can identify you, but they are not yours should you seek to control access to them.

Certainly Davis could not have prevented the provider from turning over the records, but that skirts some of the issues with this case. AT&T argued that the information it collected was sensitive enough that it should require a warrant to obtain. The government could still obtain these records (as it argues here), but it would need to reach the slightly-higher bar of "probable cause," rather than a court order or a subpoena.

The government leans on the nearly 40-year-old Smith decision as a prelude to its longer dismissal of any additional privacy expectations.

In general, courts have held that phone customers could not have maintained an actual expectation of privacy in routing-related business records made by a phone company to document transactions to which it was a party. See Smith, 442 U.S. at 741-43, 99 S.Ct. at 2580-82; United States v. Gallo, 123 F.2d 229, 231 (2d Cir. 1941). There is no cause to take a different view as to cell tower records.

The DOJ may say that cell phone records are pretty much the same as they've always been, but the dates of the cases cited don't bear this out. One decision is 35 years old. The other is 73 years old. Phone records used to be limited to phone numbers only. Now, they carry additional data, including location -- something that definitely wasn't on the courts' radar 40-70 years ago.

The DOJ then nails the point home, indicting US citizens as complicit in the removal of privacy expectations.

At any rate, Davis is not in a good position to complain that the government improperly obtained “his location data,” since he himself exposed and revealed to MetroPCS the very information he now seeks to keep private—i.e., the general vicinity information circumstantially inferable from cell tower records

"Exposed" and "revealed" are pretty harsh terms for something citizens are forced to give up in order to use cell phones. Without a doubt, many would like to keep this information private, but are unable to do so because even though they generate the records, they ultimately have no control over their distribution. Not only that, but they have considerably less access to records they've generated than law enforcement agencies do. The Third Party Doctrine has managed to turn the American public into handy little data generators -- data that the government can avail itself of with nothing more than a subpoena.

The government further asserts that Davis' stated "ignorance" of the fact that cell providers collect and store location data gives him no reason to claim an expectation of privacy. And this is true. Ignorance isn't a worthwhile excuse. But many of us do know providers store this information and yet, there's nothing that can be done about it other than to forgo the use of a cell phone altogether. That's almost an impossibility in this world, but the government maintains the stance that all of this is optional -- that we willingly create a wealth of data for third parties that can be accessed by law enforcement with minimal paperwork, let alone oversight. These are records we have no control over and yet the government is willing to use these against us while pretending we somehow have a choice in the matter.

Notably, the government also leans heavily on the Stored Communications Act to bolster its arguments -- a 30-year-old law that still treats email over 180 days old as not worthy of a warrant. Again, times have changed but applicable decisions and laws haven't. As it stands now, your life -- as stored by third parties -- is an open book.

This isn't a great test case for privacy expectations in cell phone records. Davis refused to admit ownership of the phone linking him to the string of robberies, taking a lot of the wind out of his Fourth Amendment sails in the progress. Like the Dread Pirate Roberts/Silk Road case, the government has used the denial of ownership to undercut Fourth Amendment concerns (Ulbricht has denied the servers infiltrated by the FBI are his). Defendants are basically being put in the position of incriminating themselves or abandoning any privacy arguments -- an unenviable position.

But the fact remains that location data can reveal far more about a person than the government is willing to admit. It's not simply a "business record." It's a roadmap to a person's connected existence. There should be an expectation of privacy, especially when the data gathered covers a span of days or weeks. But so far, the laws and the courts back up the government's third party assertions.

Filed Under: doj, location data, privacy, quartavious davis, smith v. maryland, third party doctrine, warrantless information
Companies: at&t

Here's Hoping Judge Ignores The Nutty Plaintiff With An Important Case On NSA Surveillance Of Business Records

from the hopefully,-hopefully dept

Many of us were excited, 11 months ago, when District Court Judge Richard Leon ruled that the NSA's bulk collection of phone metadata was unconstitutional. This was the first program revealed via the documents from Ed Snowden, and it involved the US using Section 215 of the PATRIOT Act, approved by the FISA Court with little explanation (until much later) to say that it's okay to request all phone records from Verizon. What had been often mentioned as a brief aside, is the fact that the plaintiff in the case, Larry Klayman is a bit of a conspiracy-theorist nutjob.

That came out loud and clear earlier today during the oral arguments in the appeal (Klayman had tried to go straight to the Supreme Court, which failed, though pretty much everyone expects the case to get back there eventually). Dan Froomkin, over at The Intercept, briefly discusses how Klayman's nutty rantings in the court have the potential to derail the whole thing.

But the lead plaintiff in this case is Larry Klayman, a bombastic and litigious conspiracy theorist who happened to file one of the first post-Snowden lawsuits.

And when the three-judge panel began peppering him to substantiate his claims of standing and harm, Klayman was unable to make a cogent argument. He accused the government of consistently lying and of getting “into people’s underwear.” And he cast himself personally as the victim of government surveillance and dirty tricks, saying his phone made calls he never placed and that a client’s computer had been broken into.

“I can’t talk on the phone anymore,” he complained.

He told the judges they were the last defense against tyranny, and warned them of revolution should they fail.

Riiiiiiiight.

Thankfully, Cindy Cohn from the EFF was also on hand and provided a much more legally relevant and defensible argument:

On the crucial issue of how the information being collected by the NSA differs from the information being collected in the 1979 case of Smith v. Maryland, Cohn provided the key answer that Klayman was incapable of summoning: Its size.

Smith was about one robbery suspect, whose calls were monitored for three days. “This is the untargeted mass collection of the phone calls of millions of people over many years,” Cohn said.

Judge David Sentelle interrupted: “Does it become an invasion because there’s lots of it? Or is a million times nothing still nothing?”

Cohn said American citizens have a reasonable expectation that the government isn’t logging all their phone calls all the time for no specific reason. “There are regular people making everyday phone calls, that are swept up in this.”

There's much more in the actual discussion, but this is really what the case is about. Can the courts continue to take the awful Smith v. Maryland argument, saying that it was okay to get a single phone's records from the phone company without a warrant, and extrapolate it out to mean that the government can demand every phone record of every call. There's still a lot more to go in this process, including a likely rehearing with the full DC Circuit and then the eventual Supreme Court ruling. One just hopes that Klayman's nuttiness doesn't get in the way of this important case.

Filed Under: 4th amendment, 9th circuit, appeals, cindy cohn, larry klayman, nsa, phone records, richard leon, section 215, smith v. maryland, surveillance, third party doctrine

Judge Says Supreme Court Should Overturn Awful Surveillance Precedent, But Until It Does, He Has To Reject Case Against NSA

from the a-small-step dept

We've written plenty about the case Smith v. Maryland, which established the dangerous Supreme Court precedent that there is no 4th Amendment expectation of privacy to be found in any data or information you give to a third party. Judge Richard Leon, back in December, ruled that the NSA surveillance efforts were so different from the situation in Smith (involving police getting dialing information on a single person from the phone company) that it wasn't an applicable precedent in the case in front of him, brought by Larry Klayman. That case is now being appealed.

In a new case, Smith v. Obama (assuming no relation to the "Smith" in the Maryland case), Judge Lynn Winmill, in the Idaho district court, has said that Judge Leon's ruling should be the model for a Supreme Court ruling overturning Smith v. Maryland. However, since no such ruling has taken place, he has to reject the claim in this case:

Judge Leon's decision should serve as a template for a Supreme Court opinion. And it might yet. Justice Sotomayor is inclined to reconsider Smith, finding it “ill-suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.” See U.S. v. Jones, 132 U.S. 945, 957 (2012) (Sotomayor, J., concurring). The Fourth Amendment, in her view, should not “treat secrecy as a prerequisite for privacy.”

But Smith was not overruled, and it continues – along with the Circuit decisions discussed above – to bind this Court. This authority constrains the Court from joining Klayman. Accordingly, the Court will grant the defendants’ motion to dismiss and deny Smith's motion for injunctive relief.

There's a bit more to the case overall, as it focuses on "location" data, and it's not entirely clear if the NSA is really collecting location data. However, as Judge Winmill notes, the Supreme Court's rulings in Jones suggest that the Supreme Court may be finally recognizing how outdated Smith v. Maryland is -- and it's good to see other judges recognizing this as well, even if they're constrained by existing precedent elsewhere.

Filed Under: layman, lynn winmill, nsa, richard leon, smith v. maryland, supreme court, surveillance, third party doctrine

District Court Tosses ACLU's Lawsuit Against NSA With Very Regrettable Decision That Props Up Agency Rhetoric

from the the-court-really-shouldn't-be-a-propaganda-arm-for-the-government dept

The legal battles surrounding the constitutionality of the Section 215 bulk phone records collection are now suddenly at odds with each other. A step forward (Judge Leon's decision earlier this month finding the collection to be "likely unconstitutional") has now been matched by a step backward. Judge Pauley of the Southern District of NY has found the Section 215 program to be legal and has dismissed the ACLU's lawsuit against the government. (The ACLU is planning to appeal).

Pauley refers to the same case (Smith v. Maryland) that Judge Leon referred to in his decision, but comes to very different conclusions. Pauley's ruling is predicated on the very expansive reading of the Third Party Doctrine security, intelligence and law enforcement agencies have relied on for years. Information given voluntarily to third parties is not protected by the Fourth Amendment. This reading has allowed the NSA to collect every phone record generated in the US for the past half-decade uninterrupted and for a majority of the last 12 years.

For many people, the reality of the Third Party Doctrine didn't hit home until the Snowden leaks began. It wasn't so surprising that this sort of data harvesting was happening. Whistleblowers had been warning for years that the government was collecting data and content on a massive, worldwide scale. The real shock was that, for the most part, everything was completely legal.

Judge Pauley's decision reaffirms this status quo. The opening paragraph sets the tone and lets the reader know exactly what conclusion Pauley will arrive at 54 pages later. The opening paragraph could have been ghostwritten by the ODNI.

The September 11th terrorist attacks revealed, in the starkest terms, just how dangerous and interconnected the world is. While Americans depended on technology for the conveniences of modernity, al-Qaeda plotted in a seventh-century milieu to use that technology against us. It was a bold jujitsu. And it succeeded because conventional intelligence gathering could not detect diffuse filaments connecting al-Qaeda.

Prior to the September 11th attacks, the National Security Agency intercepted seven calls made by hijacker Khalid al-Mihdhar, who was living in San Diego,California, to an al-Qaeda safe house in Yemen. The NSA intercepted those calls using overseas signals intelligence capabilities that could not capture al-Mihdhar's telephone number identifier. Without that identifier, NSA concluded mistakenly that al-Mihdhar was overseas and not in the United States. Telephony metadata would have furnished the missing information and might have permitted the NSA to notify the Federal Bureau of Intelligence ("FBI") of the fact that al-Mihdhar was calling the Yemeni safe house from inside the United States.

The footnote refers to the 9/11 Commission Report whose findings directly contradict this narrative. The problem was not that the information wasn't there. It was that it wasn't shared. It was the fact that the CIA lost al-Mihdhar, but rather than issue an alert or place him on a watch list, it chose to do nothing. Many things went wrong, but not having the intel wasn't the issue.

While Pauley does acknowledge that unchecked surveillance can result in diminished civil liberties, he restricts his arguments to the legality of the program in question. Whether or not the 215 program should continue should be turned over to the "other two coordinate branches" in Pauley's opinion, which makes his dismissal of the ACLU's injunction request partially a punt.

Pauley acknowledges Snowden's contribution to the national discussion on security and privacy (via "unauthorized disclosures") in the early pages of his decision but then proceeds to deliver the government's official depiction of this program as if the leaks, and everything that followed, never happened.

Pauley delivers the following assertions with apparent sincerity, ignoring evidence to the contrary.

Bulk telephony metadata collection under FISA is subject to extensive oversight by all three branches of government. It is monitored by the Department of Justice, the intelligence Community, the FISC, and Congress.

Oversight has been spotty at best, depending on who's controlling the dissemination of relevant information. Rep. Mike Rogers' tenure as the head of the House Intelligence Committee has been marked by deliberate and repeated obfuscation.

Since the initiation of the program, a number of compliance and implementation issues were discovered and self-reported by the Government to the FISC and Congress…[T]he NSA addressed these problems...

Except that FISC judge Reggie Walton found the abuse so pervasive and the NSA's interpretation of its own programs so misleading that he posited the 215 program had never adhered the court-imposed limitations. Further, he noted that proposed remedies were deployed haphazardly with a minimum of followup. This resulted in the program nearly being completely shut down in 2009. But Pauley presents the NSA's self-reporting as evidence of its trustworthiness -- and as more "evidence" that the oversight works.

Pauley buys everything the NSA claims about its program, from metadata not being a useful identifier (obviously untrue -- anyone with an internet connection can find out a great deal about someone or someones with little more than a handful of phone numbers) to a large portion of the database being untouched (which would normally call into question the necessity of having a database this large but is somehow portrayed as an indicator of the agency's restraint).

Pauley also addresses the limitations of the oversight pertaining to the Section 215 program, but again, finds nothing particularly wrong with the way information dissemination was handled.

The following year, when section 215 was again scheduled to sunset, senators were informed of an updated classified document available for their review. See Letter from Sens. Feinstein Chambliss to Colleagues (Feb. 8, 2011) (ECF No. 33-11). Apparently some Senators did review it while other Members of Congress did not. The House Intelligence Committee did not make the document available to members of the House. Dozens of House members elected in 2010 therefore never had an opportunity to review the classified document. While this is problematic, the Executive Branch did what it was required to do under the statutory scheme that Congress put in place to keep Congress informed about foreign intelligence surveillance.

No harm, no foul. The executive branch -- one of three branches charged with oversight -- did what it was supposed to, therefore a second branch's (intentional) failure to provide adequate oversight isn't an issue.

Pauley maintains that the collection is "necessarily broad" because fighting terrorism is a matter of prevention, rather than a matter of investigation. Since the NSA CAN'T know what it's looking for, it needs it all. This has proven to be a problem for the intelligence agency, as its tendency to collect as much as it can has swamped analysts in mountains of data, most of which serves absolutely no purpose. But Pauley ignores this reality while dismissing the ACLU's arguments, stating that the Section 215 collection will always be "relevant" to the NSA's security agenda.

But this is all a sideshow. The real question is whether the Section 215 collection violates the Fourth Amendment. Pauley looks at Smith v. Maryland and decides it does not, quoting Smith's assertion that a person has "no legitimate expectation of privacy in information he voluntarily turns over to third parties." The ACLU argued that the collection of metadata allows for the construction of a "rich mosaic" of information about any citizen and is much more revealing than the government will admit. Pauley dismisses the ACLU's "parade of horribles" by quoting none other than Gen. Alexander.

General Alexander's testimony on this point is clear:

[l]n the open press there's this discussion about pattern [that the Government is] out there doing pattern analysis on this. That is absolutely incorrect. We are not authorized to go into the data, nor are we data mining, or doing anything with the data other than those queries that we discuss, period. We're not authorized to do it. We aren't doing it. There are no automated processes running in the background pulling together data trying to figure out networks. . . . The only time you can do pattern analysis is, once you start the query on that query and where you go forward.

Pauley also makes the claim other judges have made -- if a single instance isn't a Fourth Amendment violation then the millions of simultaneous collections don't suddenly create a Fourth Amendment issue. Rights do not spring into existence based on scope.

But even as Pauley acknowledges the possibility that the ubiquity of cellphones has created a climate much different than the one the 1979 ruling took place in, he relies on that case's previous assertion to buttress his claim that no rights are being violated by the Section 215 collection. He then goes on to relay the government's arguments that security -- and the War on Terror -- should necessarily trump all constitutional objections.

Here, the balance of the equities and the public interest tilt firmly in favor of the Government's position. "Everyone agrees that the Government's interest in combating terrorism is an urgent objective of the highest order." Holder v. Humanitarian Law Project, 130 S. Ct. 2705, 2724 (2010); see also Haig v. Agee, 453 U.S. 280, 307 (1981) ("It is obvious and unarguable that no governmental interest is more compelling than the security of the Nation") (internal quotation marks omitted); In re: Directives [REDACTED] Pursuant to Section 105B of the Foreign Intelligence Surveillance Act, 551 F.3d 1004, 1012 (FISA Ct. Rev. 2008) ("[T]he relevant government interest-- the interest in national security--is of the highest order of magnitude").

The Constitution vests the President with Executive Power. U.S. Const. Art. ll. That power reaches its zenith when wielded to protect national security. Cf. Youngstown Sheet Tube Co. v. Sawyer, 343 U.S. 579, 637 (1952) (Jackson, J., concurring) ("When the President acts pursuant to an express or implied authorization from Congress," his actions are "supported by the strongest of presumptions and the widest latitude of judicial interpretation, and the burden of persuasion . . rest[s] heavily upon any who might attack it." (internal quotations omitted))...

But of all the assertions Pauley makes, this one is most incredible (and regrettable):

The effectiveness of bulk telephony metadata collection cannot be seriously disputed. Offering examples is a dangerous stratagem for the Government because it discloses means and methods of intelligence gathering. Such disclosures can only educate America's enemies. Nevertheless, the Government has acknowledged several successes in Congressional testimony and in declarations that are part of the record in this case. In this Court's view, they offer ample justification.

Even those on the direct payroll of intelligence agencies have had trouble pinpointing the program's success in preventing terrorist attacks. For Pauley to claim that the "effectiveness can't be seriously disputed" is laughable. The last several months have seen many question the effectiveness of the Section 215 program and the challenges issued by the NSA's many critics have yet to be definitively answered. Pauley treats the NSA's assertions as gospel.

When he sticks to the previous readings of the Third Party Doctrine, he's on safe ground, precedent-wise. There's no need to entertain the NSA's talking points in order to simply agree with previous rulings. The issue here is that these rulings are outdated and the Third Party Doctrine needs a serious reexamination. Pauley's allowance of the government's arguments unchallenged is the real issue here. He may not be able to find where they've violated the Fourth Amendment, but he should at least be willing to attack its tepid propaganda with the same enthusiasm he showed for dismantling the ACLU's arguments. But he didn't and now the agency has another court decision that gives its ridiculous talking points more credence.

Filed Under: 4th amendment, nsa, section 215, smith v. maryland, surveillance, third party doctrine, william pauley
Companies: aclu

Judge Says NSA Bulk Metadata Collection Likely Unconstitutional, Issues Injunction

from the stayed-for-appeal dept

Well, this is big, big news. Judge Richard Leon, a judge in the DC district court, has ruled that the NSA's bulk metadata collection should be stopped as violating the 4th Amendment, though he's put the ruling on hold, knowing that it will be appealed. This is the first major court ruling concerning the program, and the judge is pretty clear that it's a 4th Amendment violation even though the FISA court approved it. The case is actually two different cases brought by Larry Klayman, the founder of Freedom Watch, over the NSA's activities. Here's the key bit:

The Court finds that it does... have the authority to evaluate plaintiffs' constitutional challenges to the NSA's conduct, notwithstanding the fact that it was done pursuant to orders issued by the Foreign Intelligence Surveillance Court ("FISC"). And after careful consideration of the parties' pleadings and supplemental pleadings, the representations made on the record at the November 18, 2013 hearings regarding these motions, and the applicable law, the Court concludes that plaintiffs have standing to challenge the constitutionality of the Government's bulk collection and querying of phone record metadata, that they have demonstrated a substantial likelihood of success on the merits of their Fourth Amendment claim, and that they will suffer irreparable harm absent preliminary injunctive relief.

The ruling is worth reading, going through the legal history and details of the program. While it notes that the plaintiffs and the government (not surprisingly) explain the bulk metadata collection very differently, the court says that even if it accepts the government's explanation, it still likely violates the 4th Amendment. That's important.

Even while accepting the government's description of the system, it appears, thankfully, that Judge Leon is not being confused and suckered by the government's attempt to mislead. For example, in a footnote (21) the judge shows that he completely understands that the NSA is being exceptionally misleading when it implies that within all of that metadata, it's just looking at fewer than 300 individuals.

After stating that fewer than 300 unique identifiers met the RAS standard and were used as "seeds" to query the metadata in 2012, Ms. Shea notes that "[b]ecause the same seed identifier can be queried more than once over time, can generate multiple responsive records, and can be used to obtain contact numbers up to three 'hops' from the seed identifier, the number of metadata records responsive to such queries is substantially larger than 300, but is still a very small percentage of the total volume of metadata records." (emphasis added). The first part of this assertion is a glaring understatement, while the second is virtually meaningless when placed in context. First, as the sample numbers I have used in the text above demonstrate, it is possible to arrive at a query result in the millions within three hops while using even conservative numbers--needless to say, this is "substantially larger than 300." After all, even if the average person in the United States does not call or receive calls from 100 unique phone numbers in one year, what about over a five-year period? And second, it belabors the obvious to note that even a few million phone numbers is "a very small percentage of the total volume of metadata records" if the Government has collected metadata records on hundreds of millions of phone numbers.

But it's also easy to imagine the spiderweb-like reach of the three-hop search growing exponentially and capturing even higher numbers of phone numbers. Suppose, for instance, that there is a person living in New York City who has a phone number that meets the RAS standard and is approved as a "seed." And suppose this person, who may or may not actually be associated with any terrorist organization, calls or receives calls from 100 unique numbers, as in my example. But now suppose that one of the numbers he calls is his neighborhood Domino's Pizza shop. The Court won't hazard a guess as to how many different phone numbers might dial a given Domino's Pizza outlet in New York City in a five-year period, but to take a page from the Government's book of understatement, it's "substantially larger" than the 100 in the second hop of my example, and would therefore most likely result in exponential growth in the scope of the query and lead to millions of records being captured by the third hop.

Judge Leon is also well aware of the newly declassified rulings from FISC judges Walton and Bates detailing regular and drastic non-compliance by the NSA. While Judge Leon does admit to lacking jurisdiction over claims that the program violates the Administrative Procedures Act, it's the constitutional questions that are the big ones, and he does not shy away there. He notes that the FISA law does not include an expressed right of judicial review -- but neither does it bar it. And, since Congress "should not be able to cut off a citizen's right to judicial review of... Government action simply because it intended for conduct to remain secret," he finds that the court has the authority to rule on the constitutional issues.

On the question of standing (where the government often wins since individuals can't prove they've been spied on), the court sides with the plaintiffs -- noting that there's strong evidence to suggest their info has, in fact, been collected.

First, as to the collection, the Supreme Court decided Clapper just months before the June 2013 news reports revealed the existence and scope of certain NSA surveillance activities. Thus, whereas the plaintiffs in Clapper could only speculate as to whether they would be surveilled at all, plaintiffs in this case can point to strong evidence that, as Verizon customers, their telephony metadata has been collected for the last seven years (and stored for the last five) and will continue to be collected barring judicial or legislative intervention.... In addition, the Government has declassified and authenticated an April 25, 2013 FISC Order signed by Judge Vinson, which confirms that the NSA has indeed collected metadata from Verizon.

Judge Leon further mocks the Government's attempts to argue no standing, noting that their own arguments appear to contradict themselves:

Straining mightily to find a reason that plaintiffs nonetheless lack standing to challenge the metadata collection, the Government argues that Judge Vinson's order names only Verizon Business Network Services ("VBNS") as the recipient of the order, whereas plaintiffs claim to be Verizon Wireless subscribers. The Government obviously wants me to infer that the NSA may not have collected records from Verizon Wireless (or perhaps any other non-VBNS entity, such as AT&T and Sprint). Curiously, the Government makes this argument at the same time it is describing in its pleadings a bulk metadata collection program that can function only because it "creates an historical repository that permits retrospective analysis of terrorist-related communications across multiple telecommunications networks, and that can be immediately accessed as new terrorist-associated telephone identifiers come to light."

[....] Put simply, the Government wants it both ways. Virtually all of the Government's briefs and arguments to this Court explain how the Government has acted in good faith to create a comprehensive metadata database that serves as a potentially valuable tool in combating terrorism--in which case the NSA must have collected metadata from Verizon Wireless, the single largest wireless carrier in the United States, as well as AT&T and Sprint, the second and third-largest carriers.... Yet in one footnote, the Government asks me to find that plaintiffs lack standing based on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not inspire confidence!

In terms of the actual constitutional analysis, Judge Leon takes on directly the issue of metadata collection in Smith v. Maryland, the key case that the NSA and its defenders repeatedly rely on to insist that there is no 4th Amendment rights in information stored by third parties. Judge Leon notes that issue here is very different.

The question before me is not the same question that the Supreme Court confronted in Smith. To say the least, "whether the installation and use of a pen register constitutes a 'search' within the meaning of the Fourth Amendment," ... -- under the circumstances addressed and contemplated in that case--is a far cry from the issue in this case.

Indeed, the question in this case can more properly be styled as follows: When do present-day circumstances--the evolutions in the Government's surveillance capabilities, citizens' phone habits, and the relationship between the NSA and telecom companies--become so thoroughly unlike those considered by the Supreme Court thirty-four years ago that a precedent like Smith simply does not apply? The answer, unfortunately for the Government, is now.

From there, he relies on the US v. Jones case, which we've discussed extensively as well, in which the court found that attaching a GPS device to a car could be a 4th Amendment violation. He notes there that the court similarly looked at the differences in that case as compared to a previous precedent, and notes that the same situation likely applies here, vis-a-vis comparisons to Smith:

For the many reasons discussed below, I am convinced that the surveillance program before me is so different from a simple pen register that Smith is of little value in assessing whether the Bulk Telephony Metadata Program constitutes a Fourth Amendment search. To the contrary, for the following reasons, I believe that bulk telephony metadata collection and analysis almost certainly does violate a reasonable expectation of privacy.

He then goes into a detailed and thorough dismantling of Smith and why it clearly doesn't apply to this program -- noting how Smith was a very limited data collection, rather than a "collect it all" process. He even refers to the current program as "Orwellian." Furthermore, he implicates the close relationship between the NSA and the telcos, noting that this is entirely different from Smith, where police made a specific request to the telcos to turn over specific information -- rather than the telcos automatically handing over all info for the NSA to keep.

It's one thing to say that people expect phone companies to occasionally provide information to law enforcement; it is quite another to suggest that our citizens expect all phone companies to operate what is effectively a joint intelligence-gathering operation with the Government.

Finally, he points out that the amount of metadata in question is significantly more detailed and revealing than what was captured in the Smith case:

...the ubiquity of phones has dramatically altered the quantity of information that is now available and, more importantly, what that information can tell the Government about people's lives.... Put simply, people in 2013 have an entirely different relationship with phones than they did thirty-four years ago.

In this, it appears that Judge Leon was convinced by Ed Felten's declaration which, as we noted, went into great detail about how much metadata could reveal about a person today.

In the end, he says that Smith is simply the wrong case:

In sum, the Smith pen register and ongoing NSA Bulk Telephony Metadata Program have so many significant distinctions between them that I cannot possibly navigate these uncharted Fourth Amendment waters using as my North Star a case that predates the rise of cell phones.... As I said at the outset, the question before me is not whether Smith answers the question of whether people can have a reasonable expectation of privacy in telephony metadata under all circumstances. Rather, the question that I will ultimately have to answer when I reach the merits of this case someday is whether people have a reasonable expectation of privacy that is violated when the Government, without any basis whatsoever to suspect them of any wrongdoing, collects and stores for five years their telephony metadata for purposes of subjecting it to high-tech querying and analysis without any case-by-case judicial approval.

Finally, in looking at the government's insistence that the program is necessary, Judge Leon is not convinced. He notes examples of them saying it can help them do their job faster, but none of it is actually stopping an attack. In fact, he notes that for all the talk of doing the job faster, there's not been a single shred of evidence presented that it helped stop an imminent attack, where that kind of speed would matter. In fact, he notes, "none of the three 'recent examples' cited by the Government [for the need for this program] involved any apparent urgency." In short, Judge Leon is calling the government's bluff. Their only reason for needing the program is the speed it provides, but then they present no evidence of any cases where that speed was important.

Thus, the end result is an injunction against the metadata collection, but recognizing the inevitable appeal, that injunction is stayed pending appeal. This is a very good decision, but this is just the beginning.

Filed Under: 4th amendment, bulk metadata, larry klayman, metadata, nsa, patriot act, richard leon, section 215, smith v. maryland, standing, surveillance

Press Suckered By Anti-Google Group's Bogus Claim That Gmail Users Can't Expect Privacy

from the no-expectation-of-accuracy dept

Okay, so as a bunch of folks have been sending over today, there's been a bit of a furor over a press release pushed out by Consumer Watchdog, a hilariously ridiculous group that has decided that Google is 100% pure evil. The "story" claims that Google has admitted in court that there is no expectation of privacy over Gmail. This is not actually true -- but we'll get to that. This story is a bit complex because the claims in most of the news coverage about this are simply wrong -- but I still think Google made a big mistake in making this particular filing. So, first, let's explain why the coverage is completely bogus trumped up bullshit from Consumer Watchdog, and then we'll explain why Google still shouldn't have made this filing.

First off, you may recall Consumer Watchdog from previous stunts such as a putting together a hilariously misleading and almost 100% factually inaccurate video portrayal of Eric Schmidt, which was all really part of an effort to sell more copies of its founder's book (something the group flat out admitted to us in an email). They're not a consumer watchdog site -- they're a group that makes completely hogwash claims to try to generate attention on a campaign to attack Google.

The press release from Consumer Watchdog fits along its typical approach to these things: take something totally out of context, put some hysterical and inaccurate phrasing around it, dump an attention-grabbing headline on it and send it off to the press. In this case, it claimed that Google had said in a court filing that you have no expectation of privacy with Gmail. That got a bunch of folks in the press to bite with wildly inaccurate headlines:

• CNET: Google filing says Gmail users have no expectation of privacy
• Time: Google Says Gmail Users Have ‘No Legitimate Expectation of Privacy’
• The Guardian: Google: Gmail users shouldn't expect email privacy
• Gizmodo: Google: Non-Gmail Users Have No Legitimate Expectation of Privacy
• Huffington Post: Google: Email Users Can't Legitimately Expect Privacy When Emailing Someone On Gmail
• Business Insider: GOOGLE: If You Send To Gmail, You Have 'No Legitimate Expectation Of Privacy'

The first three of those headlines are simply flat-out factually incorrect. I mean, not even close, and it's fairly incredible that those come from the three more "established" or "mainstream" news publications. The last three are slightly more correct, but still completely miss the point. The best debunking of these claims so far comes from Nilay Patel at the Verge who breaks down the details. The filing, which is from over a month ago, is a response to an absolutely, monumentally bogus class action lawsuit filed against Google, arguing, hilariously, that it's a violation of wiretap laws to put ads next to emails based on the text of those emails. No, seriously.

As Patel points out, first, if you put the argument back into context, it's not even about Gmail users -- as the top three headlines above falsely state. Google is arguing that non-Gmail users are consenting to the fact that when they send an email, the ISPs who receive the email will automatically process them. This should not be controversial. At all. Without that concept email doesn't work. As the filing states (which the folks hyping this ignore):

Non-Gmail users who send emails to Gmail recipients must expect that their emails will be subjected to Google's normal processes as the [email] provider for their intended recipients.

In other words, there's no "there" there. All Google was arguing was that courts have held that if you are using a communication service, there's a perfectly reasonable (in fact, expected) recognition that the service provider will have the right to process some information about that communication. In the context of the case that Google cites, the infamous Smith v. Maryland, the argument is that the business provider is reasonably expected to be able to track the user's activity. That's not controversial. The controversial step that Smith v. Maryland then makes is to argue that because the service provider has a right to that basic information it means that the end user has no expectation of privacy with regards to the government getting access to the same info. That's the problem with Smith v. Maryland -- the failure to recognize that massive difference between me (1) consenting to let my phone company record who I make phone calls to in exchange for the ability to make calls and (2) the expectation that it's okay for the government to collect that very same info without a warrant.

Google's citation of Smith v. Maryland is to make the first half of that argument -- showing that courts recognize the obvious: that when you use a communication service, there are certain aspects of information that you know the service provider is going to have access to. Without that you don't have email, or (realistically speaking) the internet.

So, this is all much ado about nothing.

Except... I still think it was a mistake for Google to use this legal argument, and I'm somewhat surprised Google's legal team let this go through in place. First, Google does not need this citation to make this point. There are other cases that can make this point effectively without touching on the government spying aspect. But, the real reason why this is a mistake is that Google has given fairly strong indications in recent statements that it's willing to fight back against certain government requests for user info (and that it's done so in the past). In those cases, the government is absolutely going to cite Smith v. Maryland as its evidence that users have no expectation of privacy in their communications and now they'll also point out that Google cited the case approvingly. Google will want to argue that Smith v. Maryland is outdated law and was decided wrongly and/or in a different time under a different technology ecosystem. And this is a very, very strong argument that has a good chance of winning. But the ability of the government to point out that Google has, in other cases, cited the Smith precedent approvingly -- even if it was really only part of the Smith precedent -- could undermine their arguments against Smith in future cases down the road.

Either way: the freakout here is totally manufactured by a bogus, laughable group that is spreading ideas that would do massive harm to the internet based on a near total ignorance of how things work. Yes, people are on edge given the NSA revelations, but this "gotcha" is no "gotcha" at all. It's just more evidence of the sheer duplicity of Consumer Watchdog. That said, it was still short-sighted for Google to make this claim in a filing. They didn't need the citation, and while it may help them win this ridiculous class action lawsuit, it may come back to bite them down the road in more important cases.

Filed Under: 3rd party doctrine, consumer watchdog, email, fearmongering, government, hype, journalism, privacy, smith v. maryland, surveillance
Companies: consumer watchdog, google