Sixth Circuit Says Cell Site Location Data Just A Business Record; No Warrants Required
from the what-Smith-v.-Maryland-has-wrought dept
To date, four appeals courts have entered opinions on whether cell site location info is covered by the Fourth Amendment. So far, only the Fourth Circuit Court of Appeals has found this to be worthy of a warrant. All others find CSLI to be covered under the Third Party Doctrine. These cases all deal with historical cell site location info, usually obtained in bulk with subpoenas. Near real-time tracking using tower pings is another issue entirely — one that’s rarer because a) obtaining rolling CSLI from a provider is a pain and b) everyone’s using Stingrays now.
The Sixth Circuit Court of Appeals is the fourth appeals court to find CSLI isn’t covered by the Fourth Amendment. By this point, the arguments against greater privacy protections are all too familiar.
It’s Just Metadata:
Content, per this distinction, is protected under the Fourth Amendment, but routing information is not.
It’s not as precise as other tracking methods, so not really a problem:
The defendants argue that the government’s collection of those records constituted a warrantless search in violation of the Fourth Amendment. In making that argument, however, the defendants elide both the distinction described above and the difference between GPS tracking and the far less precise locational information that the government obtained here.
The amount of data gathered by the FBI is impressive. Relying on orders issued by three different magistrate judges, the FBI obtained 6-7 months of location info for 16 different cellphones. The coarse location info (accurate to within a half-mile in most cases) helped place two of the suspects near the scene of a couple of robberies. The suspects’ attempt to suppress the evidence gathered by these orders made it all the way up the chain to the Appeals Court — only to find the court affirm the lower court’s denial of their motion.
The court quotes from 1979’s Smith v. Maryland decision — the cornerstone of a majority of pro-Third Party Doctrine arguments — but fails to see any difference between obtaining call routing info tied to a non-mobile landline and information wholly unrelated to any communications generated by mobile phones as they connect to towers..
The court also quotes law enforcement’s favorite argument: that people should know things they “share” involuntarily with cell providers are also things they involuntarily share with the government.
[A]ny cellphone user who has seen her phone’s signal strength fluctuate must know that, when she places or receives a call, her phone “exposes” its location to the nearest cell tower and thus to the company that operates the tower.
As in other cases dismissed using this same rationale, this representation of what people should or shouldn’t know isn’t just inaccurate (and highly dismissive of people who don’t realize this give-and-take is part of cellphone operation) but it’s also disingenuous. People likely know they generate some sort of location information. What they don’t assume is that law enforcement can access records of their movements without a warrant.
The opinion also name-drops the Stored Communications Act — part of the abysmal Electronics Communication Privacy Act — as part of the reason the court won’t be extending an expectation of privacy to location data.
Some other points bear mention. One is that Congress has specifically legislated on the question before us today, and in doing so has struck the balance reflected in the Stored Communications Act. The Act stakes out a middle ground between full Fourth Amendment protection and no protection at all, requiring that the government show “reasonable grounds” but not “probable cause” to obtain the cell-site data at issue here. See 18 U.S.C. § 2703(d). The defendants and the ACLU effectively ask us to declare that balance unconstitutional. There is considerable irony in that request. The Katz standard asks whether the defendants’ asserted expectation of privacy “is ‘one that society is prepared to recognize as reasonable[.]’” Smith, 442 U.S. at 740 (quoting Katz, 389 U.S. at 361). Here, one might say that society itself—in the form of its elected representatives in Congress—has already struck a balance that it thinks reasonable.
Hardly. The ECPA is a farce — one that the government has used for years to obtain communications in bulk without a warrant.
Now, as to the lowered bar for obtaining CSLI — a proxy version of location tracking — historical data, especially one as “coarse” as CSLI is likely not going to be found to be worthy of Fourth Amendment protection… at least not by the courts. (Even in the Fourth Circuit decision, the concern was about the quantity of records obtained, rather than that they were obtained without a warrant.) As the opinion somewhat notes in its nod to Congress, this is an issue that needs to be addressed by legislation that more accurately reflects the privacy expectations of the public. The Stored Communications Act does not.
But courts do need to be wary of relying on Smith v. Maryland and constantly deferring to the Third Party Doctrine. Even in its coarse, historical form, CSLI reveals far more about a person’s movements than law enforcement could obtain through any other warrantless method than following suspects in person. Law enforcement should not be prevented from availing themselves of technological advances, but the benefits need to be balanced against the public’s expectations of privacy in records generated and collected as a result of phone usage.
Certainly, no one objects to pen registers for call routing data, but people honestly do not consider themselves to be nothing more than massive databanks the government can dip into with the most minimal of court oversight. Given the fact that many law enforcement agencies are deploying cell site simulators under the cover of pen register orders, the new normal should be an expectation of privacy in involuntarily-generated location data. Law enforcement likely finds coarse location data to be accurate enough for indictments and prosecutions and the continued denial of Fourth Amendment protection only encourages them to obtain CSLI with a court order rather than clear the higher evidentiary hurdles presented by the use of GPS devices.
Unfortunately, without Congressional action, most courts can only rely on legal precedent — and the bulk of it considers parties generated by members of the public but collected and stored by companies to be unprotected by the Fourth Amendment. The only thing that’s going to take Smith v. Maryland off the judicial table is new legislation or a Supreme Court decision declaring location data to have an expectation of privacy. The former seems almost as likely as the latter, but neither can truly be considered inevitable.
Filed Under: business records, cell-site location, csli, sixth circuit, third party doctrine, warrants
Comments on “Sixth Circuit Says Cell Site Location Data Just A Business Record; No Warrants Required”
Can't have it both ways
The defendants argue that the government’s collection of those records constituted a warrantless search in violation of the Fourth Amendment. In making that argument, however, the defendants elide both the distinction described above and the difference between GPS tracking and the far less precise locational information that the government obtained here.
If the data collected is ‘precise’ enough to be used in an investigation or case then it should be considered more than precise enough to require a warrant to collect and the evidence should have been surprised on those grounds. On the other hand if it’s not precise enough, then it shouldn’t be allowed to be presented as evidence in an investigation or before a judge.
If so many judges weren’t bending over backwards to give police and government agencies all the wiggle room they wanted the rule should be pretty simple to understand: If you want to track someone, and don’t feel like having someone physically tail them, then get a warrant. Doesn’t matter if you’re tracking them with a device you plant, or via something they were already carrying, get a warrant.
Found...
One Corrupt Judge…
Wish we could export these bastards!
The ECPA specifies what metadata is
Maybe I’m reading it wrong, but the ECPA (both the existing version, and the new one in congress) spell out what metadata is obtainable. Location data is not on the list:
(A) name;
(B) address;
(C) local and long distance telephone connection records, or records of session times and durations;
(D) length of service (including start date) and types of service utilized;
(E) telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and
(F) means and source of payment for such service (including any credit card or bank account number),
See USC 2703 (c)(2)
Unless you try to shoe-horn location info into “connection records”.
People should know that being born into this world that anything you do is not private.
The government doesn’t have to change the Constitution to violate people’s rights. They just have to wait for the world to evolve past the Constitution’s limitations!
If it hasn’t been completely shredded, burned to ashes and pissed on by the time the Singularity happens, how much you wanna bet the USA2.0 will justify spying on every nanosecond of every cyber-being because they had no real expectation of privacy uploading their consciousness to the Singularity?
Its time to build a Faraday cage for your phone.
Re: Re:
While it would drastically reduce how useful cell-phones are, basically making them useful for making calls but not receiving them, something like that would quite possibly be a good seller these days with police and government agencies arguing that a cell phone should really be treated as a warrant-free tracking device for anyone that uses them.
If nothing else it would be funny to watch them run around like headless chickens protesting against the wide-spread sale of such a product, claiming that ‘only criminals would ever want something like that!’ and similar rubbish. One thing to claim that anyone who carries a cell-phone is choosing to make their location public to anyone with the right tools, another entirely when the one carrying the cell-phone is actually capable of choosing to make that information ‘public’.
Re: Re: Faraday cages
Considering how many places of business post please, no phones signs, I’m surprised how they’re not used to enforce such policies. Even a faraday zone around the transaction counter shoudln’t be too hard to impliment.
But yeah a faraday sock of light chain mail would be easy to make.
Re: Re: Re: Faraday cages
Re: Re:
It’s called airplane mode.
Re: Response to: I.T. Guy on Apr 15th, 2016 @ 1:11pm
Or, you know, dont carry your phone with you when committing crimes? Or use a burner.
Re: Re: "don't carry your phone when committing crimes"
Dude. You’re already committing crimes. Surprise!
The only crime you need to commit is being an easy scapegoat or having interesting assets.
I’d suggest a wife that a captain wants to bang, but that’s to Harlequin. A few thousand dollars of easily liquifiable assets would do it, though.
Re: Re: Response to: I.T. Guy on Apr 15th, 2016 @ 1:11pm
Even burners are useless as long as you ever turn it on and or use it at your home or work. Those blimps and planes they have been flying are capable of recording the position of each phone burner and contract alike. Once they have the records, they can go back and see where the burners were first seen, last seen etc and try to figure out when someone switches phones. Probable cause has gone the way of the dinosaurs.
Re: Re:
It’s much easier for the government to enmesh the Constitution in a chicken-wire of words and pretend constitutional rights can’t leak out.
Re: I.T. Guy
Tried it 10 years ago. Didn’t go well. If the cell phone wasn’t charging, went dead in under 2 hours. If it was charging, it could also get a signal in/out. I think that airplane mode, for most cell phones, doesn’t allow YOU any access, but doesn’t stop the phone from providing info requested.
Prepaid hotspot, VPN, and VoIP.
It’s sad the lengths we have to go to protect what should be protected.
This decision should still make Stingrays illegal
If the CLSI is a business record, they can get it from the business (AT&T, Verizon, T-Mobile, etc). However, with the Stingray, I do not have a ‘business relationship’ with the user of the Stingray device, so that information should not be covered as a “business record”.
Re: This decision should still make Stingrays illegal
I have not come across any argument saying Stingray use is covered as a business record. If you have, i’d like to see it because I agree that would be a foolish conclusion.
The constitution is ever more just a scrap of paper used to wipe the behinds of those that swore oaths to safeguard it.
Re: "a scrap of paper"
What this tells us is that a constitution is not enough, and a court allegedly assigned to passively address the constitutionality of laws is not enough.
Can we take a time-out?
Imagine 25 years ago someone said that the government was going to have the capacity to track anyone and possibly everyone’s movements forever and indefinitely and access that information without a warrant. That we would not only pay for these tracking devices, but keep them charged, almost never more than an arms length away, and it would be socially unacceptable not to have one?
That person would have been labeled mentally ill.
Yet that is precisely the reality we currently inhabit.
“The Katz standard asks whether the defendants’ asserted expectation of privacy “is ‘one that society is prepared to recognize as reasonable[.]’” Smith, 442 U.S. at 740 (quoting Katz, 389 U.S. at 361). Here, one might say that society itself—in the form of its elected representatives in Congress—has already struck a balance that it thinks reasonable.”
So… the court is saying that if Congress passes a law allowing a search, the search is *automatically* reasonable? That seems to be what they are saying. I mean, if Congress passes a law allowing warrantless searches of homes at any time, I’m sure the court would strike it down – but they’d certainly have to use something other than their logic here.
One solution.
Put up your own tower. Publish every number and location data online, all day, every day. Extra points for putting it near a red light district.
I’m sure there are some judges wives who’d like to know their husbands whereabouts from time to time.
Since meta data doesn’t have any expectation of privacy, I imagine this shouldn’t be a problem. Right?
I’m also a big fan of doing the same thing with license plate readers at every country club in the nation.
Re: One solution.
“I’m also a big fan of doing the same thing with license plate readers at every country club in the nation.”
Found the CEO of Vigilant Solutions!
I honestly don’t understand the logic of the Third Party Doctrine.
I know and understand that my location is being disclosed to my cell provider, and I’m ok with that.
But just because I’m ok with my cell provider having that info, how does that equate with me automatically being ok with the government having that info?
Re: Re:
Because when you give your location to your cell provider it becomes their property which they can do with what they wish. Part of this is advertising, part of is just another part of their historically close relationship with government and law enforcement.
Re: Re:
Your cell provider is the one quietly giving your location away. Maybe you should reconsider if you’re really ok with that.
Re: Re:
The ‘logic’ is basically as follows:
If you’re willing to hand your personal data to someone else for whatever reason(and most of the time it’s because you have to to use their service), then it’s no longer ‘your’ data, and can be shared with anyone that comes asking with the right paperwork in hand(notably the ‘right paperwork’ does not need to include a warrant).
Or put another way, ‘If you’re willing to give a house-key to a friend, then you should have no issue with them being compelled to make a copy to anyone that demands one, without them having to ask your permission first or even inform you.’
As far as legal arguments go the ‘Third Party Doctrine’ is complete and utter crap. Just because someone decides to or has to hand over personal information to person A does not mean that B, C and D should have access to it as well simply by asking or ‘asking’.
Re: Re: We've established this before.
Most of the people in the justice system is less interested in serving justice and more interested in perpetuating the justice system as it currently is, even at the expense of its alleged function.
Pournelle’s Iron Law of Bureaucracy in action.
There is no logic. The arguments are the excuse. This sixth-circuit justice wants law enforcement to be able to use stingray technology because they can now and that helps preserve his status quo. Rights and ethics be damned.
Re: Re: Re:
Or put another way, ‘If you’re willing to give a house-key to a friend, then you should have no issue with them being compelled to make a copy to anyone that demands one, without them having to ask your permission first or even inform you.’
That’s what doesn’t make sense to me. I’m fine with my friend having my house key because I’d expect them to keep it safe and explicitly NOT give out copies to anyone.
In the same way, I understand that my cell phone is going to tell my provider where I am. However, I expect my provider to keep that information private, i.e. I have an “expectation of privacy” there.
On the other hand… if my provider is giving out data to the government with no warrant and I can’t sue the government… maybe I could sue the provider for breach of contract? I guess it would depend on their privacy policy?
Re: Re: Re: Re:
“I’m fine with my friend having my house key”
There are obvious social costs of harming a friendship. The power differential between friends is minimal. When the relationship is between individuals and corporations the power differential is much larger and recourse is more difficult if not impossible. Friendships don’t have forced arbitration clauses.
“I expect my provider to keep that information private”
You really shouldn’t, especially if you deal with US companies. Terms of service change and most carriers have given themselves wide berth to use your data in many ways you may not agree with, merely to create another revenue stream.
Re: Re:
because terrorism apparently means you have no rights
Re: Re: Re:
Every authoritarian’s birthday came at once when the War on Terror became a thing.
Turnabout. .
Should we start putting in foia request’s to get Location Data for any public employee’s that are provided official cell phones or reimbursed for the use of personal cell phones.
Who all would that include, law enforcement, district attorney’s, cia, nas, and maybe even judges…
Re: Turnabout. .
Of course not that’s private information there, you can’t just have it by asking for it! /s
wrong approach
You normally need a warrant to collect information NOT available to the general public. If I do not need a warrant for location data, it is to reason that this information IS available to the general public. I, therefore, demand it! What was that senators/judges/pedophiles number again?
Ok i agree /s
I am sure the politicians and judges would not mind there phones being traced by anyone and everyone live on the internet, easy to set up with google maps and something that would be very interesting to monitor, it is only business data anyway.And they are public servants and have nothing to hide, No no !!!!!
Suppose someone wanted to start a national cell phone carrier whose foundational business model was that they not going to divulge any data to anyone. How many New York Seconds would pass before people like Chuck Schumer would be screaming how dangerous this was to kidnapped children. So, of course, if there wasn’t a federal law that allowed government to demand and receive whatever records it wanted, he would be proud to introduce it.
I understand and accept that. The issue for me is that government has been granted such pervasive and routine access to any records that it wants, that they have destroyed my expectation of privacy. It no longer matters to government drone that I expect my records will be private under the Fourth Amendment. My Fourth Amendment rights have been so frequently trampled on that I expect that government will give itself a pass that is so broad that I am not allow to expect the Fourth Amendment will be shown any honest deference. It is mere words on paper that cannot stop what government wants to do.
That is why I support an Article V Convention of the States. I expect that when they pass an amendment that requires government to balance its budget that the resulting cutbacks will curb a lot of this egregious behavior simply from the lack of the money to staff their thug budget.
Re: Re:
“Suppose someone wanted to start a national cell phone carrier whose foundational business model was that they not going to divulge any data to anyone. “
That’s not even close to legally possible in the US. It wouldn’t even be possible to try to achieve it by intentionally not keeping records: current law requires a certain amount of recordkeeping just for law enforcement purposes.
a certain amount of recordkeeping required by law
I wonder if those mandated laws can be circumvented by anonymizing a connected caller before sending data, perhaps by using segregated systems for separate parts of the connecting process.
You would think...
You would think after all of these judgements that you guys would start to catch on:
1 – Cell phones work with towers, and the cell company has to keep track of where you are connected in order to make the system work and to bill out roaming or other charges as needed,
2 – business records such as these are not covered by some sort of “carrier client confidentiality” agreement. They are normal business records.
3 – You cannot operate a cellular system without this information
4 – Even if you get away from the third party doctrine, these would still be normal business records that could be subject of a warrant. There would be no privacy on this level, just one extra hurdle for law enforcemnt to jump (and a pretty low one too, similar to getting call records on a landline).
So given all of this, perhaps it’s just time to accept that legally and technically, this is an unavoidable situation, and bitching about it won’t change anything unless you change the very nature of cellular phones.
Re: You would think...
4 – Even if you get away from the third party doctrine, these would still be normal business records that could be subject of a warrant. There would be no privacy on this level, just one extra hurdle for law enforcemnt to jump (and a pretty low one too, similar to getting call records on a landline).
And there lies the main point of contention, and what I imagine is the main reason for most of the objections.
‘Subject to a warrant.’
If they got a warrant for the information they wanted people would object less, as warrants have and provide limits and require that they have their request checked by a judge for reasonability before being allowed. By instead arguing that they should be able to get the data completely without a warrant however there are no limits beyond ‘What do I feel like demanding today?’, and there’s no one to check to make sure their demands are reasonable before they make them.
Just because they might be able to get the data with a warrant does not meant they should be able to access it completely on a whim, and without applying for and getting a warrant first. If the requirements for a warrant in a given case are too high for them to meet that’s not an indicator that the requirements are too difficult(even you admit in your comment that getting a warrant is easy), it’s an indicator that they don’t have sufficient justification for their desired actions, and therefore shouldn’t be allowed to do them.
I also object to the comparison between ‘call records on a landline’ and what they are ‘asking’ for here. Call records tell you who is calling and when, that’s it. Locational data allows you near real-time tracking of someone, much more personal information, and as a result something that should require a higher standard to have access to. If police and government agents can’t just slap a tracking device on someone without a warrant they shouldn’t be allowed access to data that allows the same thing without one either.
Re: Re: You would think...
If you don’t want to get tracked, you may want to consider not carrying a device that reports your location information on a constant basis. It is the nature of a cell phone, it’s the nature of the business model, so that information will exist if you like it or not – unless you turn off your phone (and remove the battery to be safe).
The comparison with a landline phone is mostly in the sense that a warrant is needed for call information, but generally not for LOCATION information. In fact, you can go online and check many numbers and get an address back which would allow you know exactly where a phone is. It’s a business record.
My suggestion for you is really this: turn off your cell phone and stop worrying, nobody is watching you (yet).
Re: Re: Re: You would think...
The problem with cell phones isn’t that the phone company knows where the phone is. That is, as you say, unavoidable, and you’re right — the only way to stop it is to not carry a phone. The real problem is the ease of access to that information by entities who are not the phone company, and that is something that can be fixed.
Re: Re: Re: You would think...
This ties back to the ‘Get a warrant’ section of my comment above; just because the information exists doesn’t mean anyone should have unfettered access to it without demonstrating a real and pressing need for said access. If police want access to data relating to a phone, whether who called who or where it was at a given time they can go to a judge, make their case for why they think they’re justified in asking for the specific information from the phone company, and get a warrant. If that’s too difficult for them that’s just too bad.
A landline gives you the location because that never changes. The locational data you get from a landline doesn’t tell you where a person is, it tells you where a house is, so if police don’t need a warrant to link a phone number and an address it’s because houses don’t have an ‘expectation of privacy’ and because that data is public anyway, as demonstrated by the fact that simply checking the phone book gives you both pieces of information, something that is not the case with a cell-phone.
Knowing that someone lives at a given address allows you to know where they might be at any given moment, knowing where their cell-phone is on the other hand is a much more reliable way to know where the owner of it is, because for a cell-phone to be useful it has to be near you.
As I noted above if you can’t track someone’s location with a tracking device without a warrant, then you shouldn’t be able to do so just because they are carrying something that among it’s other functions can also act as a tracking device without one either.
Re: Re: Re:2 You would think...
“As I noted above if you can’t track someone’s location with a tracking device without a warrant, then you shouldn’t be able to do so just because they are carrying something that among it’s other functions can also act as a tracking device without one either.”
if you willingly carry a device that provides this information on a constant basis, it doesn’t fall into the same sort of argument as the feds putting a GPS device on your car or slipping one in your backpack. The feds aren’t make any acts here to get you to divulge information, you are doing it willingly to get the cellular service.
Like it or not, the base function of a cell phone is to know your approximate location and to provide you cellular service from the nearest / strongest tower available. The company has to know this information to operate the network, it’s basic business info. It is different from your call history or your data usage, that is for sure.
I am just thinking that with more and more courts lining up on the side of “no warrant required” it’s time to consider the implications and work with them. It doesn’t appear that this information is going to be generally suppressed by the courts, rather it’s gaining traction as a standard piece of no warrant information.
Re: Re: Re:3 You would think...
‘Willing to give that information to the phone company because they have to have it’ is significantly different than ‘Willing to give it to anyone else because they want it’. The phone company has a real need to collect and have that information, until they get a warrant anyone else, whether police or government agencies are just displaying a desire for it, and that shouldn’t be good enough. I’m sure they’d like to be able to enter any building, search any location at a whim, but they don’t get to do either unless they can present a good enough justification to a judge for why they should be allowed to. Tracking someone should be no different.
The arguments the court uses here range from bad to worse. The data is both ‘not precise’ enough to be worth special consideration, yet at the same time it’s precise enough to be used as evidence in court? There’s no real difference between a land-line and a cell-phone?
As for the main claim they like to use to justify no-warrant access, that it’s ‘public data’, that one can be disproven either by asking for their public data and watching them claim that what was public a second ago is now private, or simply by pointing out that anyone without a badge is not likely to have access to that ‘public’ data, ‘asking politely’ or not.
Even if more courts are buying the pathetic excuses for why police and other agencies ‘need’ to be able to skip the ‘Get a warrant’ step that doesn’t make it right. If the job is too hard for them then they should quit, if they can’t provide a reasonable excuse for why they need access to certain data then they don’t deserve to have it.
Re: Re: Re:4 You would think...
Is it feasible to get a lead-lined phone case to keep your phone’s location private?
Re: Re: Re:5 You would think...
Doesn’t have to be lead, and yes, you could probably get something that blocks incoming and outgoing signals, though it would probably have to be custom built since such a case seriously impacts the use of a phone by making them useful only for making calls or receiving them on a very strict schedule, rather than whenever someone might try to call you.
Even so as I noted in one of my previous comments above it would be entertaining to see someone try to mass produce something like that, if for no other reason than it would be funny watching the police freak out over a product that would actually allow people to choose whether or not to make their location ‘public’, something they claim is already the case. Seeing them try to demonize such a product by claiming that ‘Only criminals would ever use or want that!’ like they do with encryption-by-default would certainly be worth some laughs, given that much like encryption it’s their actions providing the motivation for people to want something like that.
Re: Re: Re:5 You would think...
It’s actually very easy to keep the phone’s location private.
For most phones, powering it down (actually doing the shutdown process, not just pressing the power button) or putting it in airplane mode will work fine.
To be more sure, remove the battery. Or, if you can’t take out the battery, simply wrapping it up in aluminum foil is just as effective.
Another alternative, if you want to be able to continue to use it as a computer safely, is to remove the SIM card.