Law Prof Argues Cell Location Records Shouldn't Need Warrants Because Cell Phones Have Encryption

from the towards-a-more-government-friendly-reading-of-the-4th-Amendment dept

As the Supreme Court readies itself for an important Fourth Amendment decision, the supporting briefs are beginning to trickle in. At stake is a potential redefining of the expectation of privacy under the Fourth Amendment, something that was diminished by the 1979 Supreme Court decision that created the so-called Third Party Doctrine.

In Carpenter’s case, the third party records in question are something gathered by all cell phone companies: location data. The government used months of cell site location data to retrace Carpenter’s movements, all without a warrant. This warrantless access turns cell phones into proxy tracking devices for the government. The government is perfectly fine with this turn of events and is asking the Supreme Court to uphold the lower court’s decision.

A brief [PDF] siding with the government has been submitted by George Washington University law prof (and Volokh Conspirator) Orin Kerr. In it, Kerr makes some strange arguments.

The least weird argument is Kerr’s assertion cell site location records shouldn’t be covered by the Fourth Amendment because they are the equivalent of “observation in a public space.” This is undoubtedly true, but it does allow the government to perform these “observations” without actually having to use its own eyeballs. Instead of tracking someone’s movement through direct, in-person surveillance, the government can serve a subpoena to phone companies and use constantly-collected data to perform retrospective tracking.

Kerr goes on to serve up an analogy to buttress his assertion the Fourth Amendment should provide no protection for ostensibly “public” activities. And that’s where the arguments start going off the rails.

[I]magine a world without communications networks. If Alice wants to communicate with Bob, Alice has to leave her home and travel to Bob’s house. If the police suspect that Alice and Bob are conspirators planning a crime, and they assign an officer to watch Alice’s whereabouts, the police can collect only some information without triggering the Fourth Amendment. The police cannot learn the contents of what Alice and Bob said inside Bob’s home without a warrant. On the other hand, the police can observe Alice and see what she did in public – when she left home, where she traveled, when she arrived at Bob’s house, and where they both live – without triggering the Fourth Amendment.

Next imagine that Alice calls Bob on her cell phone instead of meeting him in person. Alice no longer has to travel to meet Bob. The cell phone network delivers the call from Alice to Bob, making a remote transfer that eliminates the need for a public trip. But, critically, the same information exists. What was previously the contents of the conversation in Bob’s house is now the contents of the phone call between Alice and Bob. And what was previously Alice’s publicly observable trip from her house to Bob’s house is now a record that the phone provider generated and may keep about when the call was made, to and from what numbers, and what cell towers were used to deliver it.

What’s glossed over in this analogy is the existence of landlines. This middle step is instructive and its absence from Kerr’s brief seems almost disingenuous. For years, criminal collaborators used landlines and payphones to converse. This is what the Third Party Doctrine is predicated on: phone records. The Supreme Court’s 1979 decision forced companies to comply with (and provide technical assistance for) pen register/trap-and-trace orders. These captured numbers dialed and length of conversations. The only location of interest was already known: the residence/phone booth containing the targeted phone. If law enforcement wanted information on suspects’ movements, they still needed to deploy some form of additional surveillance.

Kerr is arguing law enforcement should have access to people’s public movements without having to do the actual legwork. And he starts this argument by ignoring the fact law enforcement has — for years! — been unable to do anything more than collect phone records sans location data. But now phone records also contain information about people’s movements, and Kerr believes they should be inseparable and easily-accessible. This assertion is made despite Kerr attempting to draw a straight line from the good old days of walking from house to house directly through CSLI and email header info.

To maintain the balance of the Fourth Amendment, courts should treat the same information in the same way in both the physical and network contexts. The contents of phone calls should be protected, as they are the telephone equivalent of protected inside space. This means, in the Internet context, that the contents of e-mails, text messages, and files that users place in cloud storage should receive full Fourth Amendment protection. On the other hand, non-content records generated by network providers – the business records they generate about how they delivered the communications – should not be protected because they are the network equivalent of the publicly observable trip that is outside such protection in the physical world.

Going on from there, Kerr says the court — along with legislators — must maintain an “equilibrium” between expectations of privacy and lawful access. But in this case, the equilibrium must shift towards the government. Why? Because criminals use cell phones.

The ways that cell phones can facilitate crime and avoid detection counsels against creating new Fourth Amendment protections for cell phone records. Obviously, most people don’t use their phones to commit crimes. But most people don’t have their records collected by court order under the Stored Communications Act, either. The key point is that the effect of cell phone technology on the “often competitive enterprise of ferreting out crime,” Johnson v. United States, 333 U.S. 10, 14 (1948), operates as a two-way street. The ability of cell phone companies to deliver communications quickly and silently over any distance cuts both ways. It can lead to records about the delivery that helps the police, and it can aid in the commission of crime that helps wrongdoers. Both should be considered.

He’s right that both should be considered. But his argument doesn’t suggest both should be considered. Kerr believes the government’s view should be given priority — a view that allows for no narrowing of the Third Party Doctrine. No one should be granted a higher expectation of privacy because criminals use cell phones. That’s basically the argument. And it leads directly to this argument, which isn’t any better. The Third Party Doctrine should remain intact because people — including criminals — use encryption.

It is too early to tell how far encryption will interfere with government investigative powers. But because users generally can’t encrypt non-content records such as historical cell-site records, the collection of such records may take on a more important role in future surveillance practices. The Court should be reluctant to introduce new constitutional protections for non-content records when the existing constitutional framework for access to contents may be impeded by new encryption technology.

I’m honestly unsure what to make of that argument, which seems to imply the Court should only view the Fourth Amendment as an avenue for law enforcement access, rather than its true purpose: protecting citizens from their government. Kerr talks about maintaining a balance, but posits that relevant technological advancements should work for the government, rather than against it. If people can have encryption and little metal-and-glass rectangles that allow them to hold private, long distance conversations, then the government should have uninterrupted, warrantless access to anything the government deems to be a “third party records.”

This isn’t the way to maintain balance. The Fourth Amendment isn’t the government’s enabler. And it never has been. It was written to curb government overreach and abuse. The government has been dealing with unobservable conversations for decades now. That it can now track people without ever leaving the office may be handy, but it doesn’t necessarily follow it should always be able to do this without a warrant. The Supreme Court should take a close look at the implications of allowing the status quo to remain in place. Thousands of electronic devices generate millions of third party records every day, all less than a warrant away. Ignoring these implications in favor a simplistic rehashing of a forty-year-old decision is only going to cause further difficulties down the road.

Filed Under: , , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Law Prof Argues Cell Location Records Shouldn't Need Warrants Because Cell Phones Have Encryption”

Subscribe: RSS Leave a comment
39 Comments
That One Guy (profile) says:

Only a problem for those without a case

This means, in the Internet context, that the contents of e-mails, text messages, and files that users place in cloud storage should receive full Fourth Amendment protection.

While this sounds nice at face value, what he says later rather nearly undermines his ‘the content should be protected’ claim, by arguing that because the content should be protected location data shouldn’t be, so that it can help fill in the ‘gaps’ left by that pesky ‘encryption’ getting in the way.

The Court should be reluctant to introduce new constitutional protections for non-content records when the existing constitutional framework for access to contents may be impeded by new encryption technology.

New constitutional protections’? You can follow someone around without a warrant, it just takes effort, yet I’m pretty sure that if you want to place a tracking device on say their car you do need a warrant, because it’s generally considered that that’s an invasion of their privacy a step farther than having someone tail them.

The fact that people are carrying a device that can also double as a tracking device should not mean that the warrant requirement magically goes away, because the privacy implications certainly didn’t, and if anything they are even more extensive as people can carry a phone where they would leave a car behind.

What it really comes down to is that a warrant requirement is only a problem if the agents/officers involved are grossly incompetent, incredibly lazy, have no credible case or evidence, or a mix of the above. ‘Getting a warrant’ is not a huge problem if those involved in an investigation have more than a flimsy hunch, so the fact that this issue has reached the point of consideration by the US Supreme Court does not paint a good picture of the police and government agencies taking advantage of a system to go on baseless fishing expeditions looking for something juicy.

Anonymous Coward says:

The least weird argument is Kerr’s assertion cell site location records shouldn’t be covered by the Fourth Amendment because they are the equivalent of "observation in a public space." This is undoubtedly true

No, I doubt it’s true. Regular people cannot observe the RF spectrum, and even with a special device (see Kyllo v. United States about observation with specialty devices from public space), the IMSI isn’t just transmitted in the clear. You’ll either need an IMSI catcher actively impersonating the cellular network, or help from the carrier that holds the encryption keys. The public can’t realistically do it.

Anonymous Anonymous Coward (profile) says:

Re: Re:

Then there is the additional issue of how IMSI (Stingrays) also capture all the cellphones in their area, rather than just the one being tracked. Are those other people with cellphones having their Fourth Amendment rights violated just because they are in a ‘public place’, where that ‘public place’ might be their home or office?

Does Kerr’s equation change when someone is in a private place physically but they are assumed to be in a public place rhetorically because they have a cellphone?

Roger Strong (profile) says:

Re: Re:

Regular people cannot observe the RF spectrum

They can. Scanners are cheap and easily available. Mine even connects to my network and monitors several types of digital trunked systems used by emergency services these days.

But as you elaborate, the difference is encryption. Only the police may demand the decrypted metadata.

BTW, some police services are encrypting their signals. But like cellular networks the trunking system that controls those signals offers a wealth of metadata. The app that comes with my scanner doesn’t have a tool to look at it, but there’s a command in the programming API that will fetch it.

Anonymous Coward says:

More encryption needed

It is too early to tell how far encryption will interfere with government investigative powers. But because users generally can’t encrypt non-content records such as historical cell-site records

It’s time to use more encryption to interfere with those powers. It’s not even technically that difficult, we just need the cellular equivalent of Tor to ensure those records don’t exist (or more accurately, can’t identify a specific user).

David says:

There is no question of balance.

The Constitution lines out what is the sole government’s business. Some of the founders thought that should be enough, but finally they still added the Bill of Rights that explicitly lines out where government never must reach.

This is the last bulwark of the citizens. Talking about how much of a breach we need in it in order to maintain balance is madness.

Anonymous Coward says:

What a bunch of voyeurs. Is there a watch list of those who enjoy peeping upon the unsuspecting? Apparently this is a prerequisite for political appointment and career politicians. What, exactly, is so enjoyable or attractive about this strange and creepy behavior?

Just because something is possible does not mean it should be done. Usually one goes through, at a minimum, a cost/benefit analysis – so what is the cost and what is the benefit?

The cost can not be measured and the benefit is limited to those in positions of power and influence. There is nothing but the consequences for the remainder of the population who is encouraged to accept their personal responsibilities and deal with whatever lousy conditions are tossed at them, and they had better not complain or it’s the gulag for them.

DannyB (profile) says:

Re: Re:

Your phone can be tracked by cell towers it is in contact with. So you also need to disconnect your phone from the network. (eg, airplane mode)

If you’re really paranoid, probably don’t then enable WiFi while in airplane mode.

GPS is only a receiver, not a transmitter. The received GPS data tells THE PHONE where it is at. Now the phone can do anything with that information, including sending it to the cloud to obtain, for example, map information, and advertisements that Taco Bellyache is two blocks ahead. Thus the cloud now knows where your phone is. Your phone (or some app such as your mapping app) might maintain a log of where it has been.

DannyB (profile) says:

How is Encryption connected with Cell Location?

Even if everything on your phone is fully encrypted, what does that have to do with the cellular network tracking your devices location based on the cell towers it gets near to?

Whether your device is or is not encrypted is unrelated to whether the government should be able to get your phone’s location from third parties without a warrant.

Personanongrata says:

Legal Malpratice

Kerr believes the government’s view should be given priority — a view that allows for no narrowing of the Third Party Doctrine. No one should be granted a higher expectation of privacy because criminals use cell phones. That’s basically the argument. And it leads directly to this argument, which isn’t any better. The Third Party Doctrine should remain intact because people — including criminals — use encryption.

Following Orin Kerr’s defective line of reasoning – that the US governments investigatory needs outweigh the Rights of American citizens because criminals may use certain items during the planning and operational stages of their criminal acts – the US Constitution is for all intents and purposes a dead-letter.

John E Cressman (profile) says:

Really?

"I’m honestly unsure what to make of that argument…"

It’s actually pretty clear. Those are the arguments of someone who supports a tyrranical, all-powerful government where rights are "GIVEN" by the government – and when something is GIVEN, it can be taken away, seemingly for any reason THEY find legit… Terror, think of the children, easier for law enforcement, because it’s Tuesday…

Anonymous Coward says:

You've noticed the intrinsic drawback to cell phones and computers.

“Instead of tracking someone’s movement through direct, in-person surveillance, the government can serve a subpoena to phone companies and use constantly-collected data to perform retrospective tracking.”

Yot. It’s the 21st century, sonny.

The whole cell phone system not only has this intrinsic and necessary ability, but “They” designed it in. — And you don’t even want to know about the even worse computer operating systems!

Anonymous Coward says:

Re: You've noticed the intrinsic drawback to cell phones and computers.

But in practice, you’ll be no more observed than when walking down the street. Though, with cameras and computer face recognition — whoops, alarming you again for how “technology” is making a prison. Forget I mentioned.

A key point omitted as always here is Techdirt has NO problem with Google tracking everyone all over the net — and giving “direct access” to NSA according to Snowden — in fact regards tracking by corporations as desirable, instead focuses in on this rather small and logical extension.

Anonymous Coward says:

Re: Re: Re: You've noticed the intrinsic drawback to cell phones and computers.

In both cases the phone company will still have a record of your phone’s location from their tower data

No, the infrastructure company will have a record of some unknown phone at that tower. They don’t need to know whose phone it is, they just need to know it paid. And the company that assigns your phone number just needs an open communication channel to route calls to you, they don’t need to know where you are.

and from your phone.

Is it their phone or my phone? If it’s under my control it’s not going to give up those records.

Anonymous Coward says:

Re: Re: You've noticed the intrinsic drawback to cell phones and computers.

Location-tracking is not a necessary ability.

For mobile phones, it is as the system has to deal with handoffs between cell towers, and to know which towers to route incoming messages and calls to. However, keeping records of that tracking beyond beyond current location is not required.

Anonymous Coward says:

Re: Re: Re: You've noticed the intrinsic drawback to cell phones and computers.

For mobile phones, it is as the system has to deal with handoffs between cell towers, and to know which towers to route incoming messages and calls to.

Nope. You can think of a mobile phone like a Tor hidden service. Those migrate around the network constantly, but we can always reach them at their address even though we don’t know where they went. There’s a data path, but nobody knows the full path.

A handoff would be like resuming a Tor connection from another IP address. I’ve no idea whether it works, but it’s easy in principle (simple cryptography: open a new connection to one of the nodes in your circuit, and use the key to prove your the same person from a new address).

Anonymous Coward says:

Re: Re: Re:2 You've noticed the intrinsic drawback to cell phones and computers.

With TOR, the user builds a route through the network for a connection, which remains fixed for that connection. That is connection and does not change mid document. Also, hidden services use a middlemen nodes as the endpoint for user connections, and those nodes relay the traffic to and from the servers so that neither end has a direct connection. However connection still remain static for each transaction, such as getting a document a document.
With a mobile phone an established connection, needs to be switchable to a different tower while the call is in progress, hence the need to keep track of individual phones, and predict which towers the will likely be switched to. This also applies to Internet connection with the phone, where the tower may be switched mid document.

The crucial difference is that TOR has static routing for the lifetime of a (TCP) connection, while mobile phones need the ability for predictive dynamic rerouting.

Anonymous Coward says:

Re: Re: Re:3 You've noticed the intrinsic drawback to cell phones and computers.

The crucial difference is that TOR has static routing for the lifetime of a (TCP) connection, while mobile phones need the ability for predictive dynamic rerouting.

Yeah, currently, but where’s the fundamental limitation? If you have ip_A->entry_node->node_2->…, moving the connection to ip_B->entry_node->node_2 would be possible with some simple cryptography. (It shouldn’t matter than ip_A and ip_B come from different towers.) Even though the original TCP connection to entry_node is no longer usable, entry_node can keep its connection to node_2 open so it can be resumed. TLS already allows sessions to be resumed in a similar way.

With a mobile phone an established connection, needs to be switchable to a different tower while the call is in progress, hence the need to keep track of individual phones, and predict which towers the will likely be switched to.

A phone could connect to several towers independently, just to get an IP address. When it wants to switch, connect to entry_node from the second IP and resume the connection.

I can do all of this today with WiFi: generate a random MAC for each access point, connect to my .onion-based VPN from that IP, and use VoIP over that. When that connection drops, I reconnect to the VPN from the new IP, and since my VPN always gives my the same static IP, all my connections stay open if I’m quick enough. My VoIP provider knows who I am, but as far as they know I’m coming from my regular IP. (Latency isn’t great for voice but email and web browsing are fine.)

Jeremy Lyman (profile) says:

Stop Right There

Can I, as a public citizen, request and receive these location records about anyone with 3rd party phone records? No? Then it’s not public information, is it? The only reason the government has access to this info is because it’s the government, and any analogy you draw trying to claim this private information is akin to public is invalid.

Leave a Reply to Anonymous Anonymous Coward Cancel reply

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Ctrl-Alt-Speech

A weekly news podcast from
Mike Masnick & Ben Whitelaw

Subscribe now to Ctrl-Alt-Speech »
Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...