I was recently in a discussion concerning the type of process needed for law enforcement to obtain a tower dump from a service provider. A tower dump allows police to request the phone numbers of all phones that connected to a specific tower within a given period of time. Beyond this list, law enforcement could also request customer information, allowing them to match the cell numbers with a specific customer's name, address, and other account information.
Under the Stored Communications Act (SCA), information can be obtained from phone companies (and other service providers) by use of a subpoena, 2703(d) order, or search warrant, depending on the type of data requested. For example, a subpoena can be used to obtain basic subscriber information. However, account logs and transactional records require a 2703(d) order - which requires specific and articulable facts to believe the records are relevant to an ongoing criminal investigation.
So the question to my readers is this - what type of process is required for a tower dump? We're just curious as to how easily phone companies are giving the information away. The specific and articulable facts standard seems too high for a tower dump, but a subpoena doesn't exactly seem sufficient. Or does a tower dump even fit under the SCA since that report alone only gives away phone numbers and not account information? Please leave a comment to this article if you have any ideas.
Last month, the ACLU released a report on the use of cell site data by law enforcement. Click here for my earlier post.
Although this is a Canadian case you might be interested in reading the trial decision in R. v. Mahmood, 2008 CanLII 51774 and the subsequent appeal found at 2011 ONCA 693.
ReplyDeleteThis was a case where the Toronto police obtained production orders to dump the cell towers in the vacinity of a commercial robbery to identity possible suspects.
While it did identify the suspects, the trial judge had a problem with the fact that 7000 other customers information was also obtained, however the information was still admitted and the targets were convicted.
On review the Ontario Court of Appeal had little problem with the search as the police had acted under valid court orders.
Both cases give a good over view of the issues surrouding tower dumps in Ontario, Canada. While not the USA, the laws between the two countires are very similar.
All Canadian case law can be found on www.canlii.org (the Canadian Legal Information network).
It's an interesting question. Off the top of my head, I think the best answer is probably a 2703(d) order -- it is compelled access to non-content records not covered by 2703(c)(2). But it's not an easy issue: It depends on whether a cell phone customer whose records are being processed by another provider counts as a "customer" of the provider, triggering SCA rights. There's no obvious answer to that, I think.
ReplyDeleteExcellent point - I hadn't thought about the effect of roaming users. Logically, one would think that SCA-type protections should apply even when a person is off-network, but reasonable arguments could certainly be made for both definitions.
Delete