CBP Tells Senator Ron Wyden It Will Stop Buying Location Data From Third Parties

Privacy

from the definitely-the-most-trustworthy-of-pinkie-swears dept

In 2018, the Supreme Court handed down the Carpenter decision. That decision built on the one declaring phones off limits without a warrant — one delivered four years earlier. The rationale was this: phones are always on, all-knowing, and everywhere all the time.

Given the amount of data generated by everyday smartphone use, the Supreme Court (in these two decisions) decided to expand Fourth Amendment coverage not only to phones, but to the location data they generated continuously in order to provide service to phone owners.

The Carpenter decision said obtaining long-term location data from cell service providers now required a warrant. These records were no longer mere “third party” records. Instead, they were records capable of allowing the government to track a person’s whereabouts (and infer things about those locations). As such, probable cause was needed to obtain these records — ones now removed from the blanket coverage of the Third Party Doctrine.

Faced with this new reality, the government began searching for warrantless alternatives. Brokers hoovering data from unaware phone users (via installed apps that may or may not have warned them location data would be gathered) became the new source for third party records. In fact, this collection of data was one third party removed from the original third party: the app collecting the data.

Given this distance, the government assumed it was constitutional to do the same thing the Carpenter decision prohibited, since it wasn’t gathering location data directly from cell service providers. And by “government,” I mean pretty much all of it. The feds got on top of it, spending tax dollars to provide the DEA, ICE, CBP, Defense Department, and many other federal agencies with location data harvested from phone app users.

Once this new collection became public knowledge, other components of the federal government — namely, certain legislators actually interested in protecting Americans’ rights — got involved. Senator Ron Wyden led the charge to end this warrantless collection of location data determined by the highest court in the land to be protected by the Fourth Amendment (albeit within narrow confines).

Congressional investigations were opened into this new breed of data merchants. That did little to deter federal agencies from purchasing data from brokers currently under investigation. Legislators applied more pressure. But these actions had little result… at least, up until now.

As Joseph Cox reports for the recently-formed 404 Media, the CBP has, at least for the time being, assured Senator Wyden it will no longer purchase location data from opportunistic brokers.

Customs and Border Protection (CBP) has told Sen. Ron Wyden that it plans to stop using commercially sourced smartphone location data at the end of this month, Wyden’s office told 404 Media.

This is good news. But there are caveats, the first of which is the timing. Apparently, the CBP is willing to collect it all until the end of this month, which seems a bit opportunistic for someone promising to kick the data broker habit cold turkey.

Then there’s this, which suggests the CBP has found another source for this data — one that has not, as of yet, been made public.

CBP told 404 Media it determined the agency does not have a current need to buy more access to such data. 

No “current need” to “buy more access.” Hmm. I wonder what that means in plain English. It could be that it’s found another source for this data. Or it could mean it’s currently in possession of so much data, it doesn’t feel the need to add more to its current collection. Or it could mean the data harvested by data brokers is less useful than alternatives that may actually require warrants.

The latter might be the most likely explanation, at least according to statements obtained by Cox and 404 Media. Sure, it’s easy to gather location data in bulk from brokers, but the data collected from (likely intermittent) app use is going to be incomplete. And, in cases, where suspects are already difficult to identify, the data may only serve to obscure the intended target, rather than help law enforcement hone in on its prey.

Agencies have not necessarily been successful at tracking individual targets with such data. Senator Wyden’s office previously found that the criminal investigation unit of the IRS tried and failed to track criminal suspects in a year-long Venntel contract.

Of course, the government isn’t adverse to throwing good money at bad intel. That’s how so many government contractors remain lucrative. But when results matter, paying for access to inconsistent data may frustrate federal agents enough they’re willing to give up heavily criticized collection methods and actually act a bit more constitutional when performing investigations.

Whatever the case, it’s probably best federal agencies begin weaning themselves off this particular data teat. A lot of federal agencies are already considered flagrant rights violators. And not just because they routinely violate rights. A Republican cabal with considerable power is seeking to punish the so-called “deep state” by limiting surveillance powers. While the CBP and its foreigner-ousting directives may align with these Republicans’ interests, the overall distrust of federal surveillance efforts might see warrantless collections like these curbed in the future.

And that means Senator Wyden may have unlikely allies willing to push through his legislation that would mandate warrants for collecting location data from sources not specifically covered by the Carpenter decision. Sometimes the best bedfellows Americans can have are the strange ones.

Filed Under: cbp, data, data brokers, dhs, privacy, ron wyden