4th Amendment Lives: Court Tells US Government Get A Warrant If It Wants Mobile Phone Location Info
from the look-at-that dept
A potentially big ruling came out of the courtroom of Judge Lucy Koh yesterday, in which she affirmed a magistrate judge’s decision to tell the government to get a warrant if it wants to obtain historical location info about certain “target” mobile phones (officially known as “Cell Site Location Info” — or CSLI). The government sought to use a provision of the Stored Communications Act (a part of ECPA, the Electronic Communications Privacy Act) to demand this info without a warrant — using a much lower standard: “specific and articulable facts” rather than the all important “probable cause.” Judge Koh says that’s doesn’t pass 4th Amendment muster, relying heavily on the important Supreme Court rulings in the Jones case, involving attaching a GPS device to a car, and the Riley case about searching mobile phones.
Based on the preceding U.S. Supreme Court cases, the following principles are manifest: (1) an individual?s expectation of privacy is at its pinnacle when government surveillance intrudes on the home; (2) long-term electronic surveillance by the government implicates an individual?s expectation of privacy; and (3) location data generated by cell phones, which are ubiquitous in this day and age, can reveal a wealth of private information about an individual. Applying those principles to the information sought here by the government, the Court finds that individuals have an expectation of privacy in the historical CSLI associated with their cell phones, and that such an expectation is one that society is willing to recognize as reasonable.
This is big. Obviously, the government is likely to appeal, and so as a first pass, this might seem meaningless. We’ve still got an appeals court (and possibly a rehearing) and a Supreme Court to get to, but as a first ruling, it’s a good one. Koh’s analysis is pretty thorough. It notes the similarities to both the Jones and Riley cases:
Here, as in Jones, the government seeks permission to track the movement of individuals?without a warrant?over an extended period of time and by electronic means. CSLI, like GPS, can provide the government with a ?comprehensive record of a person?s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations.? Riley, 134 S. Ct. at 2490 (quoting Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring)). With the proliferation of smaller and smaller base stations such as microcells, picocells, and femtocells?which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home, …?the government is able to use historical CSLI to track an individual?s past whereabouts with ever increasing precision. See Riley, 134 S. Ct. at 2490 (explaining that a cell phone?s ?[h]istoric location information . . . can reconstruct someone?s specific movements down to the minute, not only around town but also within a particular building?). At oral argument, the government agreed that in some instances CSLI could locate an individual within her home, … and did not dispute that CSLI will become more precise as the number of cell towers continues to multiply…. This admission is of constitutional significance because rules adopted under the Fourth Amendment ?must take account of more sophisticated systems that are already in use or in development.?…
In fact, the information the government seeks here is arguably more invasive of an individual?s expectation of privacy than the GPS device attached to the defendant?s car in Jones. This is so for two reasons. First, as the government conceded at the hearing, over the course of sixty days an individual will invariably enter constitutionally protected areas, such as private residences…. Tracking a person?s movements inside the home matters for Fourth Amendment purposes because ?private residences are places in which the individual normally expects privacy free of governmental intrusion not authorized by a warrant, and that expectation is plainly one that society is prepared to recognize as justifiable.? Karo, 468 U.S. at 714; see also Kyllo, 533 U.S. at 31 (?At the very core of the Fourth Amendment stands the right of a man to retreat into his own home and there be free from unreasonable governmental intrusion.? (internal quotation marks omitted)). As one court put it, ?Because cellular telephone users tend to keep their phone on their person or very close by, placing a particular cellular telephone within a home is essentially the corollary of locating the user within the home.? ….
Second, the government conceded at oral argument that, compared to GPS tracking of a car, the government will ?get more information, more data points, on the cell phone? via historical CSLI… (?But, yes, of course the person has the phone more than they have their car, most people at least do, so it gives [the government] more data.?). Cell phones generate far more location data because, unlike the vehicle in Jones, cell phones typically accompany the user wherever she goes…. Indeed, according to a survey cited by the U.S. Supreme Court in Riley, ?nearly three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting that they even use their phones in the shower.?….
Judge Koh points to some survey data from Pew (sent in by EFF) noting that many, many people consider their location information to be “sensitive information” and, on top of that, the fact that CSLI is generated even if someone turns off the GPS or “location data” features on their phone — meaning they can’t even opt out of generating such information to try to keep it private.
More importantly, Judge Koh takes on the issue of the infamous third party doctrine and the awful Smith v. Maryland precedent, which says you have no expectation of privacy in data held by third parties. To date, the Supreme Court has punted on this issue in the Jones and Riley cases. However, Koh addresses the issue head on, and says the third party doctrine should not apply to phone location data like this. The key issue: in the Smith case, the “information” that was given to the third party was the phone number being dialed. This was information that the caller voluntarily conveyed to the phone company in order to make the call. Judge Koh points out that this information is quite different:
Cell phone users, by contrast, do not ?voluntarily convey? their location to the cellular service provider in the manner contemplated by Miller and Smith. This is especially true when historical CSLI is generated just because the cell phone is on, such as when cell phone apps are sending and receiving data in the background or when the cell phone is ?pinging? a nearby cell tower. As the government?s FBI special agent explained, ?CSLI for a cellular telephone may still be generated in the absence of user interaction with a cellular telephone.? …. ?For example,? the special agent continued, CSLI may be generated by ?applications that continually run in the background that send and receive data (e.g. email applications).? … At oral argument, the government confirmed that its § 2703(d) application authorizes the government to obtain historical CSLI generated by such activities.
[….] In so doing, a cell phone periodically identifies itself to the closest cell tower?not necessarily the closest cell tower geographically, but the one with the strongest radio signal?as it moves through its network?s coverage area…. This process, known as ?registration? or ?pinging,? facilitates the making and receiving of calls, the sending and receiving of text messages, and the sending and receiving of cell phone data…. Pinging nearby cell towers is automatic and occurs whenever the phone is on, without the user?s input or control…. This sort of pinging happens every seven to nine minutes….
In Miller and Smith, the individual knew with certainty the information that was being conveyed and the third party to which the conveyance was made. Cell phone users, on the other hand, enjoy far less certainty with respect to CSLI. CSLI, in contrast to deposit slips or digits on a telephone, is neither tangible nor visible to a cell phone user. When the telephone user in Smith received his monthly bill from the phone company, the numbers he dialed would appear…. The CSLI generated by a user?s cell phone makes no such appearance…. Rather, because CSLI is generated automatically whenever a cell tower detects radio waves from a cell phone, a cell phone user typically does not know that her phone is communicating with a cell tower, much less the specific cell tower with which her phone is communicating…. It may be, as the government explained, that a cell phone connects to ?many towers? during the length of a call,… and the tower to which a cell phone connects is not necessarily the closest one geographically…. Moreover, when an app on the user?s phone is continually running in the background, … she may not be aware that the cell phone in her pocket is generating CSLI in the first place.
And thus, even with the third party doctrine, this information is quite different than that discussed in the Smith v. Maryland case, which involved phone numbers dialed:
In light of the foregoing, the Court concludes that historical CSLI generated via continuously operating apps or automatic pinging does not amount to a voluntary conveyance of the user?s location twenty-four hours a day for sixty days. Such data, it is clear, may be generated with far less intent, awareness, or affirmative conduct on the part of the user than what was at issue in Miller and Smith. Unlike the depositor in Miller who affirmatively conveyed checks and deposit slips to the bank, or the telephone user in Smith who affirmatively dialed the numbers recorded by the pen register, a cell phone user may generate historical CSLI simply because her phone is on and without committing any affirmative act or knowledge that CSLI is being generated. Smith, for example, never contemplated the disclosure of information while the landline telephone was not even in use.
This sort of passive generation of CSLI does not amount to a voluntary conveyance under the third-party doctrine.
Judge Koh notes that this ruling isn’t rejecting the ruling in Smith — rightly noting that only the Supreme Court can determine that it’s no longer good law — but notes that the ruling there is different enough from this one that it does not apply. Ideally, the Supreme Court will get around to rejecting the ridiculous third party doctrine altogether, but if it must stand, a ruling like this is helpful in returning just a bit of 4th Amendment protected privacy to the American public.
Filed Under: 4th amendment, csli, ecpa, location information, lucy koh, privacy, probable cause, sca, warrant
Companies: aclu, eff
Comments on “4th Amendment Lives: Court Tells US Government Get A Warrant If It Wants Mobile Phone Location Info”
Lucy Koh. That name sounds familiar.
Wasn’t she the judge who presided over the travesty of Apple’s patent-trolling of Samsung?
One case in a million. Judge Koh will be slapped back into line quickly enough.
The appeal will be interesting to see
Koh appears to have crossed her Ts and dotted her Is, more or less pretending there were an independent judiciary.
This will not likely stand on appeal but it will be interesting to see if the government’s effort on the appeal argument will be significantly better than “we don’t like this, make it go away”. Or whether they cannot really be bothered with maintaining the illusion that the U.S. is a nation governed by law.
Re: The appeal will be interesting to see
It will fall to the 3rd party doctrine anyways…
You are already sharing the data with someone, we will just get it from THEM with a NSL!
hahaha… fuck this judge, we didn’t need her anyways!
tis but a flesh wound!
Third party doctrine
I’m glad to see that Judge Koh managed to carve out a difference between data that we voluntarily provide, the phone number, from other data like CSLI. If it sticks, it’ll be a good too see how it applies elsewhere, such as email addresses vs. IP addresses in email headers, etc.
I do wish however that we could start talking about the difference in privacy between sharing information with a business vs. Government. Sharing my email or searches with Google, or my purchasing patterns with Visa, or my dialed numbers (and location) with my phone provider, is voluntary. I can easily choose another provider of their service or choose other alternatives (e.g. cash instead of credit card, paper mail instead of email) if they behave badly, such as publish or leak my private details, or deliver intrusive advertising.
More importantly though, unlike the Government, the business can’t violate my constitutional rights or deprive me of liberty based on what I share with them. Allowing the Government to easily access that same data is entirely different, as they can send me to GITMO or at a minimum destroy my life trying to defend myself.
The dangers of Government access to masses of data I chose to (privately) share with a business in exchange for a service are clear and obvious, and should require a court approved warrant.
Re: Third party doctrine
…the business can’t…deprive me of liberty based on what I share with them…
Notwithstanding the telemarketing scammers I’ve had businesses assume I’ve consented to telemarketing calls (including to my cel phone) simply because I did business with one of their units. No I did not say or write anywhere such consent. And I did business with ‘business X’, NOT ‘parent of business X’. As far as I’m concerned the ‘parent’ is a different business. I had to write them to get them to stop; most never replied but the legitimate calls have stopped.
As far as I’m concerned unwanted telemarketing is a deprivation of liberty.
Re: Re: Third party doctrine
I understand that telemarketing calls are annoying, and we’d all like them to stop. However, they can generally be ignored and as you point out, sometimes even stopped.
But it’s awfully hard to ignore some ladder-climbing attorney in the Justice Department. The Government’s power far exceeds that of a telemarketer to make your life suck. No comparison.
Re: Re: Re: Third party doctrine
It’s not easy to ignore incoming calls that drain your ten buck a month pay as you go minutes, and why is it incumbent upon us to stop them? They should be forced to get permission to start in the first place.
They’re our phones, not theirs! We’re paying the bill for it. Why are we expected to accept (eg.) Verizon getting its corporate nose out of joint so we end up getting robo-called half a million times because their billing data is SNAFU’d?
As for the comparison between some schmuck prosecutor vs. privates screwing with you, I’d rather have neither, thank you very much. One baddie with huge power vs. a thousand ticks sucking your blood are equally unattractive to me. They’re both evil.
Re: Third party doctrine
When the government compels information from a third party that it is prohibited from obtaining directly without a warrant, that action is tantamount to the actual illegal seizure; it’s a clear end-run around constitutional requirements. When they invoke third party doctrine, the state twists the meaning of the law and becomes indistinguishable from criminals.
Meanwhile in the whitehouse......
HELP! Someone successfully defended the 4th amendment! Quick, someone slap it down with Presidential orders before someone notices!
This is really, really good. But how long is it going to take until the judicial system catches up with new technologies? Is the lag time acceptable enough to protect the rights of the general public?
>the proliferation of smaller and smaller base stations such as microcells, picocells, and femtocells—which cover a very specific area
Wow, she totally nailed it. It’s great that there are people who actually understand technology. The legal professionals that did the research in order to come to this ruling deserve a lot of praise.
I would believe this would matter if there was some evidence that the government just ignores people’s rights and the laws when they get in their way of oppressing people
So, what’s it really like to live in a cave? Do they come with heat these days? Do you have animal paintings on the walls and everything? How about plumbing?
I suspect the EFF website can provide all the evidence you’re looking for. IJJ is worth looking into as well.
There's a waterproof phone?
I’m curious what phone those 12% are using in the shower, and how (or if) it manages to survive. Think of how much time I could save in my morning routine if I could read my daily email while I shower!
Re: There's a waterproof phone?
The Samsung Galaxy Sport models are waterproof up to 1 meter deep. It’s not much, but plenty good enough to text in the shower!
Re: Re: There's a waterproof phone?
Do text while procreating as well? 🙂
Re: There's a waterproof phone?
When I’m in the shower, I’m generally showering. This sounds like a really dumb idea to me. I don’t want to be hunting for the soap I dropped or a cell phone.
Perhaps a wallmounted waterproof display could make sense, but it’s going to get all fogged up in there. How’s about finishing your shower, then check mail as your hair’s drying?
I still think German politician Malte Spitz’s website showing how Deutsche Telekom tracked his movements over 6 months using Cell Site Location Info is the best visual for how invasive this technology is.