Featured Paper: Bridging the Cellular Divide: A Search for Consensus Regarding Law Enforcement Access to Historical Cell Data

From the February 2014 Issue of the Cardozo Law Review:

Zachary Ross, Bridging the Cellular Divide: A Search for Consensus Regarding Law Enforcement Access to Historical Cell Data.

Excerpt:

Technological change is often a double-edged sword--it enables and enriches our lives, but also allows for new means of exploitation and control. As social, architectural, and market barriers protecting longstanding notions of personal space erode, individuals increasingly rely on the legal system as a defense to arbitrary invasions of privacy. Paradoxically, the same forces that make the need for robust privacy protections more compelling also make the existing legal framework outdated and inapposite. 

These contradictions are readily apparent in the contemporary debate over the legal restrictions on government access to cell site location information (CSLI). This data, constantly collected by cell phone service providers (CSPs) in order to manage their networks, has the potential to provide a detailed map of an individual cell user's movements from place to place over extended periods of time. Furthermore, the quantity and precision of location data collected by CSPs is constantly increasing, becoming more revealing, and more valuable to law enforcement in the process. Despite the potential intimacy of this data and its growing relevance to criminal investigations, the legal protection afforded CSLI is hotly disputed, and at present varies greatly among (and sometimes even within) jurisdictions-- with courts sometimes requiring a warrant, and sometimes allowing unfettered access upon a lesser evidentiary showing. This lack of uniformity has been exacerbated by a recent Fifth Circuit ruling on government access to CSLI, which generated a different rule than had previously been adopted by the Third Circuit. The vastly disparate treatment of government requests for CSLI has created a chaotic system ripe for abuse, and all but guaranteed Supreme Court review of the issue in the near future, as the Court itself seems to have implicitly acknowledged. 

This Note will examine the complex interaction between privacy, surveillance, and technology through an exploration of the contested legal terrain governing law enforcement access to historical CSLI--location data recorded by CSPs which reveal an individual's past movements. 

Read More

Massive round-up of new law articles, covering privacy, Fourth Amendment, GPS, cell site, cybercrime, big data, revenge porn, drones, and more

Spencer, Shaun B., The Surveillance Society and the Third-Party Privacy Problem (2013). South Carolina Law Review, Vol. 65, No. 2, 2013. Abstract: 

This Article examines a question that has become increasingly important in the emerging surveillance society: Should the law treat information as private even though others know about it? This is the third-party privacy problem. Part II explores two competing conceptions of privacy — the binary and contextual conceptions. Part III describes two features of the emerging surveillance society that should change the way we address the third-party privacy problem. One feature, “surveillance on demand,” results from exponential increases in data collection and aggregation. The other feature, “uploaded lives,” reflects a revolution in the type and amount of information that we share digitally. Part IV argues that the binary conception cannot protect privacy in the surveillance society because it fails to account for the new realities of surveillance on demand and uploaded lives. Finally, Part V illustrates how courts and legislators can implement the contextual conception to deal with two emerging surveillance society problems — facial recognition technology and geolocation data.

Kimberly N. Brown, Anonymity, Faceprints, and the Constitution, 21 Geo. Mason L. Rev. (forthcoming Winter 2014).

Jane Bambauer, Is Data Speech?, 66 Stan. L. Rev. 57 (2014). Abstract:

Privacy laws rely on the unexamined assumption that the collection of data is not speech. That assumption is incorrect. Privacy scholars, recognizing an imminent clash between this long-held assumption and First Amendment protections of information, argue that data is different from the sort of speech the Constitution intended to protect. But they fail to articulate a meaningful distinction between data and other more traditional forms of expression. Meanwhile, First Amendment scholars have not paid sufficient attention to new technologies that automatically capture data. These technologies reopen challenging questions about what “speech” is. 

This Article makes two overdue contributions to the First Amendment literature. First, it argues that when the scope of First Amendment coverage is ambiguous, courts should analyze the government’s motive for regulating. Second, it highlights and strengthens the strands of First Amendment theory that protect the right to create knowledge. Whenever the state regulates in order to interfere with the creation of knowledge, that regulation should draw First Amendment scrutiny. 

In combination, these claims show clearly why data must receive First Amendment protection. When the collection or distribution of data troubles lawmakers, it does so because data has the potential to inform and to inspire new opinions. Data privacy laws regulate minds, not technology. Thus, for all practical purposes, and in every context relevant to privacy debates, data is speech.

Elizabeth E. Joh, Privacy Protests: Surveillance Evasion and Fourth Amendment Suspicion, 55 Ariz. L. Rev. 997 (2014). Abstract:

The police tend to think that those who evade surveillance are criminals. Yet the evasion may only be a protest against the surveillance itself. Faced with the growing surveillance capacities of the government, some people object. They buy “burners” (prepaid phones) or “freedom phones” from Asia that have had all tracking devices removed, or they hide their smartphones in ad hoc Faraday cages that block their signals. They use Tor to surf the internet. They identify tracking devices with GPS detectors. They avoid credit cards and choose cash, prepaid debit cards, or bitcoins. They burn their garbage. At the extreme end, some “live off the grid” and cut off all contact with the modern world. 

These are all examples of what I call privacy protests: actions individuals take to block or to thwart government surveillance for reasons unrelated to criminal wrongdoing. Those engaged in privacy protests do so primarily because they object to the presence of perceived or potential government surveillance in their lives. How do we tell the difference between privacy protests and criminal evasions, and why does it matter? Surprisingly scant attention has been given to these questions, in part because Fourth Amendment law makes little distinction between ordinary criminal evasions and privacy protests. This Article discusses the importance of these ordinary acts of resistance, their place in constitutional criminal procedure, and their potential social value in the struggle over the meaning of privacy.

Conor M. Reardon, Cell Phones, Police Recording, and the Intersection of the First and Fourth Amendments, 63 Duke Law Journal 735-779 (2013). Abstract:

In a recent spate of highly publicized incidents, citizens have used cell phones equipped with video cameras to record violent arrests. Oftentimes they post their recordings on the Internet for public examination. As the courts have recognized, this behavior lies close to the heart of the First Amendment. 

But the Constitution imperfectly protects this new form of government monitoring. Fourth Amendment doctrine generally permits the warrantless seizure of cell phones used to record violent arrests, on the theory that the recording contains evidence of a crime. The Fourth Amendment inquiry does not evaluate a seizing officer’s state of mind, permitting an official to seize a video for the very purpose of suppressing its contents. Moreover, Supreme Court precedent is typically read to ignore First Amendment interests implicated by searches and seizures. 

This result is perverse. Courts evaluating these seizures should stop to recall the Fourth Amendment’s origins as a procedural safeguard for expressive interests. They should remember, too, the Supreme Court’s jurisprudence surrounding seizures of obscene materials—an area in which the Court carefully shaped Fourth Amendment doctrine to protect First Amendment values. Otherwise reasonable seizures can become unreasonable when they threaten free expression, and seizures of cell phones used to record violent arrests are of that stripe. Courts should therefore disallow this breed of seizure, trusting the political branches to craft a substitute procedure that will protect law-enforcement interests without doing violence to First Amendment freedoms.

Elizabeth Friedler, Protecting the Innocent—the Need to Adapt Federal Asset Forfeiture Laws to Protect the Interests of Third Parties in Digital Asset Seizures, Cardozo Arts & Entertainment Law Journal, Volume 32, Issue 1 (2013).

Jana Sutton, Of Information, Trust, and Ice Cream: A Recipe for a Different Perspective on the Privacy of Health Information, 55 Ariz. L. Rev. 1171 (2014). Abstract:

The concept of privacy is inescapable in modern society. As technology develops rapidly and online connections become an integral part of our daily routines, the lines between what may or may not be acceptable continue to blur. Individual autonomy is important. We cannot, however, allow it to suffocate the advancement of technology in such vital areas as public health. Although this Note cannot lay out detailed instructions to balance the desire for autonomy and the benefits of free information, it attempts to provide some perspective on whether we are anywhere close to striking the right balance. When the benefits of health information technology are so glaring, and yet its progress has been so stifled, perhaps we have placed far too much value—at least in the health care context—on individual privacy.

Kevin S. Bankston & Ashkan Soltani, Tiny Constables and the Cost of Surveillance: Making Cents Out of United States v. Jones, 123 YALE L.J. ONLINE 335 (2014). Abstract:

In United States v. Jones, five Supreme Court Justices wrote that government surveillance of one’s public movements for twenty-eight days using a GPS device violated a reasonable expectation of privacy and constituted a Fourth Amendment search. Unfortunately, they didn’t provide a clear and administrable rule that could be applied in other government surveillance cases. In this Essay, Kevin Bankston and Ashkan Soltani draw together threads from the Jones concurrences and existing legal scholarship and combine them with data about the costs of different location tracking techniques to articulate a cost-based conception of the expectation of privacy that both supports and is supported by the concurring opinions in Jones.

Schmitt, Michael N. and Vihul, Liis, The International Law of Attribution During Proxy 'Wars' in Cyberspace (January 30, 2014). 1 Fletcher Security Review (2014 Forthcoming). Abstract:

The article examines the use of non-State actors by States to conduct cyber operations against other States. In doing so, it examines attribution of a non-State actor's cyber operations to a State pursuant to the law of State responsibility, attribution of a non-State actor's cyber armed attack to a State for the purposes of a self-defense analysis, and attribution of cyber military operations to a State in the context of determining whether an international armed conflict has been initiated. These three very different legal inquiries are often confused with each other. The article seeks to deconstruct the issue of attribution into its various normative components.

Kate Crawford & Jason Schultz, Big Data and Due Process: Toward a Framework to Redress Predictive Privacy Harms, 55 B.C. L. Rev. 93 (2014). Abstract:

The rise of “Big Data” analytics in the private sector poses new challenges for privacy advocates. Through its reliance on existing data and predictive analysis to create detailed individual profiles, Big Data has exploded the scope of personally identifiable information (“PII”). It has also effectively marginalized regulatory schema by evading current privacy protections with its novel methodology. Furthermore, poor execution of Big Data methodology may create additional harms by rendering inaccurate profiles that nonetheless impact an individual’s life and livelihood. To respond to Big Data’s evolving practices, this Article examines several existing privacy regimes and explains why these approaches inadequately address current Big Data challenges. This Article then proposes a new approach to mitigating predictive privacy harms—that of a right to procedural data due process. Although current privacy regimes offer limited nominal due process-like mechanisms, a more rigorous framework is needed to address their shortcomings. By examining due process’s role in the Anglo-American legal system and building on previous scholarship about due process for public administrative computer systems, this Article argues that individuals affected by Big Data should have similar rights to those in the legal system with respect to how their personal data is used in such adjudications. Using these principles, this Article analogizes a system of regulation that would provide such rights against private Big Data actors.

Larkin, Paul J., 'Revenge Porn,' State Law, and Free Speech (January 14, 2014).  Abstract:

For most of our history, only celebrities — presidents, movie stars, professional athletes, and the like — were at risk of having their everyday exploits and activities photographed and shown to the world. But that day is gone. Today, we all face the risk of being made into a celebrity due to the ubiquity of camera-equipped cell phones and the ease of uploading photographs or videos onto the Internet. But a particularly troubling aspect of this phenomenon goes by the name of "revenge porn" — that is, the Internet posting of photographs of naked former wives and girlfriends, sometimes in intimate positions or activities. Revenge porn is an example of malicious conduct that injures the welfare of someone who mistakenly trusted an intimate partner. Tort law traditionally has allowed parties to recover damages for such violations of privacy, and criminal law also can prohibit such conduct, but there are several First Amendment defenses that the responsible parties can assert to fend off liability. This article argues that allowing a victim of revenge porn to recover damages for publication that breaches an implicit promise of confidentiality is faithful to tort and criminal law principles and will not punish or chill the legitimate expression of free speech.

Jonathan Olivito, Beyond the Fourth Amendment: Limiting Drone Surveillance Through the Constitutional Right to Informational Privacy, 74 Ohio St. L.J. 669 (2013). 

The entirety of Volume 74, Issue 6 in the Ohio State Law Journal; Symposium: The Second Wave of Global Privacy Protection (Titles Below)

Peter Swire, The Second Wave of Global Privacy Protection: Symposium Introduction, 74 Ohio St. L.J. 841 (2013). 

Ann Bartow, Privacy Laws and Privacy Levers: Online Surveillance Versus Economic Development in the People’s Republic of China, 74 Ohio St. L.J. 853 (2013). 

Andrew Clearwater & J. Trevor Hughes, In the Beginning . . . An Early History of the Privacy Profession, 74 Ohio St. L.J. 897 (2013). 

Claudia Diaz, Omer Tene & Seda Gürses, Hero or Villain: The Data Controller in Privacy Law and Technologies, 74 Ohio St. L.J. 923 (2013). 

A. Michael Froomkin, “PETs Must Be on a Leash”: How U.S. Law (and Industry Practice) Often Undermines and Even Forbids Valuable Privacy Enhancing Technology, 74 Ohio St. L.J. 965 (2013). 

Woodrow Hartzog, Social Data, 74 Ohio St. L.J. 995 (2013). 

Dennis D. Hirsch, In Search of the Holy Grail: Achieving Global Privacy Rules Through Sector-Based Codes of Conduct, 74 Ohio St. L.J. 1029 (2013). 

Gus Hosein & Caroline Wilson Palow, Modern Safeguards for Modern Surveillance: An Analysis of Innovations in Communications Surveillance Techniques, 74 Ohio St. L.J. 1071 (2013). 

Anil Kalhan, Immigration Policing and Federalism Through the Lens of Technology, Surveillance, and Privacy, 74 Ohio St. L.J. 1105 (2013). 

Bartosz M. Marcinkowski, Privacy Paradox(es): In Search of a Transatlantic Data Protection Standard, 74 Ohio St. L.J. 1167 (2013). 

Thomas Margoni & Mark Perry, Deep Pockets, Packets, and Harbors, 74 Ohio St. L.J. 1195 (2013). 

Omer Tene, Privacy Law’s Midlife Crisis: A Critical Assessment of the Second Wave of Global Privacy Laws, 74 Ohio St. L.J. 1217 (2013). 

Yofi Tirosh & Michael Birnhack, Naked in Front of the Machine: Does Airport Scanning Violate Privacy? 74 Ohio St. L.J. 1263 (2013). 

Yang Wang, Pedro Giovanni Leon, Xiaoxuan Chen, Saranga Komanduri, Gregory Norcie, Kevin Scott, Alessandro Acquisti, Lorrie Faith Cranor & Norman Sadeh, From Facebook Regrets to Facebook Privacy Nudges, 74 Ohio St. L.J. 1307 (2013). 

Tal Z. Zarsky & Norberto Nuno Gomes de Andrade, Regulating Electronic Identity Intermediaries: The “Soft eID” Conundrum, 74 Ohio St. L.J. 1335 (2013).

The entirety of Volume 14, Issue 1 of the  Journal of High Technology Law (2014) (Titles Below).

After Jones, The Deluge: The Fourth Amendment's Treatment Of Information, Big Data And The Cloud , Lon A. Berk, 14 J. High Tech L. 1 (2014). 

The Legislative Response To Employers' Requests For Password Disclosure, Jordan M. Blanke, 14 J. High Tech L. 42 (2014). 

A Shot In The Dark: An Analysis Of The SEC's Response To The Rise Of Dark Pools Edwin Batista, 14 J. High Tech L. 83 (2014). 

Privacy Protections Left Wanting: Looking At Doctrine And Safeguards On Law Enforcements' Use Of GPS Tracking And Cell Phone Records With A Focus On Massachusetts, Lloyd Chebaclo, 14 J. High Tech L. 120 (2014).

Read More

Case files (briefs + argument) for two key cases before Mass. Sup. Ct.: forced decryption (5th Amendment) and cell site location

The Massachusetts Supreme Judicial Court has two cases before it to keep an eye on. Summaries from the court, briefs, and links to oral argument are below.

SJC-11358
Commonwealth v. Gelfatt
Criminal; Self-incrimination-- Whether the Commonwealth's request in a criminal case for a court order compelling the defendant to enter his encryption key to access information on a computer seized by the Commonwealth violates the defendant's rights against self-incrimination.

Appellant Commonwealth Brief
Appellee Gelfgatt Brief
Appellant Commonwealth Reply Brief
ACLU Foundation Brief
Amicus Criminal Defense Lawyers Brief
Amicus Criminal Defense Laywes Brief [sic] (In support and joined by NACDL)
Amicus FL Dept Of Law Enforcement Brief
Amicus Opderbeck Brief

Notable events:
11/05/2013 --- Oral argument held. (Ireland, C.J., Spina, J., Cordy, J., Botsford, J., Gants, J., Duffly, J., Lenk, J.).

Oral Argument Video

SJC-11482
Commonwealth v. Augustine

Search and Seizure-- In a murder prosecution, the Commonwealth is appealing a Superior Court judge's order allowing the defendant's motion to suppress historic cell site location information relating to the defendant's cellular phone number; the District Attorney's Office obtained the information in connection with a murder investigation without a search warrant by means of a judicial order pursuant to a federal statute.

Appellant Commonwealth Brief
Appellee Augustine Corrected Brief
Appellant Commonwealth Reply Brief
Amicus Electronic Frontier Brief
Amicus Criminal Defense Brief

Notable events:

10/10/2013 --- Oral argument held. (Ireland, C.J., Spina, J., Cordy, J., Botsford, J., Gants, J., Duffly, J., Lenk, J.).

Oral Argument Video

10/24/2013 --- #18 ORDER (By the Court): Before the court in this case is the Commonwealth's appeal pursuant to G. L. c. 278, § 28E, and Mass. R. Crim. P. 15(a)(2), from a decision of a Superior Court judge granting the defendant's motion to suppress evidence, including records that would show [the] defendant's location at a particular time, obtained pursuant to a warrantless search and seizure of cell phone records pertaining to a telephone number that, it appears, was used exclusively by the defendant. It is not disputed that some or all of the evidence in question referred to as cell site location information (CSLI) -- was obtained by the Commonwealth from Sprint Spectrum, an electronic communications service provider, pursuant to a Superior Court order issued pursuant to 18 U.S.C. § 2703(d)(§ 2703(d) order). The defendant has been provided with a copy of the CSLI that is at issue, but no copy was included in the motion record before the Superior Court and no copy has been included in the record on appeal. This case was argued before this court on October 10, 2013. The court is of the view that the CSLI obtained pursuant to the § 2703(d) order that is the subject of the defendant's motion to suppress may assist the court in its understanding and consideration of the issues raised in the Commonwealth's appeal. The court hereby directs the single justice to hold a hearing on the question whether the appellate record should be expanded to include the CSLI evidence, and if so, what conditions may be appropriate to adopt with respect to such an expansion. The single justice will provide the full court with a recommendation concerning what, if any, order should issue. Counsel is to confer with the Clerk of this court to schedule the hearing.

Read More

New Jersey Supreme Court holds that police must get warrant for cell site data

In State v. Earls, No. 068765 (N.J. 2013), the Supreme Court of New Jersey held that police must obtain a warrant in order to get cell site location information (CSLI) unless an exception to the warrant requirement applies.

During the investigation of several burglaries, police contacted - without a warrant - T-Mobile at three different times in one evening to obtain cell site data for the defendant's cell phone. The trial court found that the defendant had a reasonable expectation of privacy in the location of his cell phone and a warrant should have been obtained. However, they further found that the emergency aid exception to the warrant requirement applied. The defendant pled guilty.

On appeal, the intermediate appellate court found that the "defendant had no constitutionally protected privacy interest" because he had "no reasonable expectation of privacy in [his] movements on public highways or the general location of [his] cell phone."

In its decision, the Supreme Court disagreed with the Appellate Division, noting that the state's constitution provides greater protection than the Fourth Amendment and finding that police must obtain a warrant before acquiring CSLI.

[P]eople do not buy cell phones to serve as tracking devices or reasonably expect them to be used by the government in that way. We therefore find that individuals have a reasonable expectation of privacy in the location of their cell phones under the State Constitution.

However, the court noted that recognized exceptions are still applicable and thus remanded to the Appellate Division for consideration of the emergency aid doctrine or other warrant exceptions.

Read More

Maryland appeals court reverses conviction due to lay witness testimony connecting defendant to crime scene with CSLI

In a recent Maryland case, the Court of Special Appeals found that it was improper for the trial court to use lay testimony from a detective to suggest that the defendant's cell phone was in close proximity to the location of the crime. Because the detective was not presented as an expert witness on the technology, the testimony was improper, and the conviction was reversed and remanded. Payne v. State, No. 2156 (Md. Ct. Spec. App. 2013).

The defendant had been charged and convicted of first-degree felony murder. At trial, the detective testified as to how he was able to use call records to find the cell tower in which the defendant's phone was connected at the time of the call. Defense counsel objected, arguing that the detective was "offering expert testimony without a proper foundation." The detective was allowed to testify without the proper foundation.

On appeal, the defendant argued that the cell site location information should not have been allowed from a lay witness. The state countered, "there was no 'opinion' testimony, lay or otherwise, in this case and, even if it did constitute opinion testimony, there was no need for the State to produce an expert to testify regarding the facts relating to appellants' cell phone records."

Ultimately, here's what caused the appeals court to take issue with the testimony:

Subsequent to the court's ruling, Detective Edwards testified that a telephone call from Bond's cell phone registered off of a cellular tower "at a latitude and longitude of 39.350854 by negative 76.696565 located on Menlo Drive" which was approximately one and one half to two miles away from the crime scene at approximately the time when the crime occurred. At approximately 1:00 a.m. on August 27, 2007, another call had been placed from Bond's cell phone registering off of a cellular tower at latitude and longitude 39.34364 by negative 76.72851, a location known as Balmoral Towers, located approximately one mile from the crime scene. Over objection, Detective Edwards then identified the map which has been generated as a mapping program that depicted the aforesaid locations. Finally, Detective Edwards testified that Paynes' cellular-phone activated off of one of the towers located in proximity to the crime scene at 10:02 a.m. on August 26, 2007.

Because the testimony was improperly allowed by a lay witness, it was in error. The court found the testimony to be "critical," and thus reversed and remanded the case.

Read More

Quick details on H.R. 983, the ECPA reform bill announced today

From House Representative Zoe Lofgren's release:

Reps. Zoe Lofgren (D-San Jose), Ted Poe (R-TX) and Suzan DelBene (D-WA) today introduced bipartisan legislation modernizing the 1986 Electronic Communications Privacy Act (ECPA. Consumers and businesses are increasingly using cloud computing and location-based services, but the law has failed to keep pace with technology – leading to weak and convoluted privacy protections from government access to user data. The bill, H.R. 983, the Online Communications and Geolocation Protection Act, would strengthen the privacy of Internet users and wireless subscribers from overbroad government surveillance by requiring the government to get a warrant based on probable cause before intercepting or forcing the disclosure of electronics communications and geolocation data.

A copy of the bill can be found here: H.R. 983 - Online Communications and Geolocation Protection Act

A summary (section by section) of the major changes can be found here: H.R. 983 Summary of Changes 

The bill requires, inter alia, a warrant for GPS tracking and CSLI tracking, with limited exceptions (FISA, emergency, consent, etc.). Another section from the Rep. Lofgren's release sums it up nicely:

Rep. Lofgren's Online Communications and Geolocation Protection Act would apply Constitutional privacy guarantees under the Fourth Amendment to an individual's digital communications and location data while minimizing the impact on law enforcement investigations. The bill would: 

Require the government to obtain a warrant to access to wire or electronic communications content; 

Require the government to obtain a warrant to intercept or force service providers to disclose geolocation data; 

Preserve exceptions for emergency situations, foreign intelligence surveillance, individual consent, public information, and emergency assistance; 

Prohibit service providers from disclosing a user's geolocation information to the government in the absence of a warrant or exception;

Prohibit the use of unlawfully obtained geolocation information as evidence; 

Provide for administrative discipline and a civil cause of action if geolocation information is unlawfully intercepted or disclosed.

Read More

Mistrial declared in Antoine Jones' third trial

Antoine Jones, the defendant in the high-profile Supreme Court case on GPS tracking United States v. Jones, had his third trial declared a mistrial yesterday. Since his arrest in 2005, the feds have repeatedly tried to prosecute him for drug crimes.

Jones' first trial also resulted in a mistrial, but it was his conviction after a second trial that led to the landmark Supreme Court decision that modified the Fourth Amendment as we know it. After the high court forbade the government from using the evidence they had collected as a result of a GPS tracking device on Jones' vehicle, the government went back to trial using location information acquired from Jones's cell phone.

Last week, jurors notified District Court Judge Ellen Segal Huvelle that they had deadlocked, 6-6, after seven days of deliberations. The U.S. Attorney's Office says it plans to again retry Jones.

In the latest of trials, Jones chose to represent himself. The parties are expected to appear back in court this afternoon.

Read More

Jones II: District court holds that SCA's lack of suppression remedy and the good faith exception allows admission of CSLI

In the continuing saga of the case against Antoine Jones, the DC district court has held that the use of Jones's cell site location information does not violate the Fourth Amendment. United States v. Jones, No. 05-0386 (D.D.C. 2012). In January, the Supreme Court ruled that location information acquired as a result of law enforcement placing a GPS device on Jones's car could not be used at trial as it violated the Fourth Amendment.

During the initial investigation, law enforcement obtained both GPS data and cell site data but only sought to use the GPS data at trial. After the Supreme Court's determination that such data could not be used, the government sought to have CSLI introduced at Jones's retrial. The four months of cell site information had been obtained from Cingular Wireless under a 2703(d) order pursuant to the Stored Communications Act in 2005.

Jones's first motion to suppress argument was that prospective CSLI data (that which is acquired by the phone company after the order is issued rather than seeking "historical" data already obtained) cannot be obtained under the SCA without probable cause. The court held that a majority of courts have agreed, but the argument is irrelevant because the SCA does not provide a suppression remedy. Thus, regardless of a successful argument, the data would still be admissible under the SCA.

Of course, Jones's second argument was under the Fourth Amendment, which if successful would allow for suppression. The court thoroughly examined the different approaches for analyzing the Fourth Amendment's application to orders to obtain CSLI. However, the court declined to decide the issue, finding that the good-faith exception would apply, reasoning that at the time the order was obtained, the officers had no way of knowing how future courts would rule on prospective CSLI, and even today, the issue is not settled.

Read More

District court upholds CSLI order with erroneous phone number, finds defendant doesn't have standing

In United States v. Cannon, No. 6:11-cr-02302 (D.S.C. 2012), the court held that a typographical error did not violate an order for cell site data and that the defendant's failure to prove he had an interest in the phone removed his ability to challenge the search for lack of standing.

The defendant had been charged with multiple crimes related to the distribution of drugs. As part of the investigation, law enforcement obtained GPS data from his cell phone company. He filed a motion to suppress, arguing that the data was obtained in violation of his constitutional rights.

In challenging the use of the data, the defendant argued that the court order was invalid because it contained a phone number different than the one that information was provided for. The court found the argument to be without merit, holding, "Mere typographical errors do not undermine a finding of probable cause and do not invalidate a warrant." Because the correct number was used elsewhere, it was clear that it was a mistake.

The government argued that the defendant did not have standing because he was not the owner or authorized user of the phone. The defendant was unable to prove that he had any interest in the phone, and thus could not challenge any potential Fourth Amendment violation.

Read More

Mass. trial court finds obtaining one day of CSLI without cause to violate the Mass. Constitution

In Commonwealth v. Wyatt, 30 Mass. L. Rep. 270 (Mass. Sup. Ct. 2012), the Superior Court of Massachusetts held that obtaining cell site location information (CSLI) without a showing of cause (the court did not specify if probable cause was a requirement) was a violation of the Massachusetts Constitution. As a result of this finding, the defendants' motions to suppress were granted.

As part of a murder investigation, law enforcement acquired nine 2703(d) orders covering five different cell phone companies and eighteen phone numbers seeking subscriber information and call records for a near two-month period and CSLI for one day. Officers later admitted they did not have probable cause to acquire this information. The four defendants filed a motion to suppress their historical CSLI .

The court began by discussing the similarities of cell phones and a GPS device, noting that "CSLI enables a cellular telephone to be treated as a de facto Global Positioning System (GPS) tracking device." As such, they conducted an evaluation of a state high court opinion in Connolly (holding that installation of a GPS device on a vehicle is a seizure) and the Supreme Court's opinion in Jones.

Next, the court applied the expectation of privacy test to the use of CSLI. Because "[i]t is unlikely that the average cellular telephone user knows that when he or she makes or receives a call or a text message, the service provider creates and maintains a record of the cellular telephone’s location," the defendants had a subjective expectation of privacy in the cell records.

As to an objective expectation of privacy, the court held:

Allowing the government to track our movements without evidence that the person whose CSLI is sought engaged in criminal activity compromises what it means to be a citizen of the United States of America free from arbitrary surveillance.... 

Allowing the government to track a citizen’s movement through CSLI, without requiring the government to show probable cause or even reasonable suspicion that the target is engaged in criminal activity is contrary to the very freedom we hold dear.

Thus, the defendant's motion to suppress their cell site location information was granted.

Cybercrime Review blogger Justin Webb contributed to this post.

Read More

GAO produces report on cell location data protection

The Government Accountability Office recently released a report entitled "Mobile Device Location Data: Additional Federal Actions Could Help Protect Consumer Privacy." It covers:

(1) how mobile industry companies collect location data, why they use and share these data, and how this affects consumers;
(2) the types of actions private sector entities have taken to protect consumers’ privacy and ensure security of location data; and
(3) the actions federal agencies have taken to protect consumer privacy and what additional federal efforts, if any, are needed.

The GAO recommends that mobile industry companies adopt a variety of practices, enforce their policies consistently, and implement certain safeguards to protect the data. Additionally, employees must be held accountable for policy breaches. Action was also recommended for the FTC, FCC, and Department of Commerce.

Read More

EFF files amicus in D.C. Circuit Court against use of CSLI in remanded Jones case

Back in April, Jeffrey wrote that Antoine Jones wasn't off the hook for his crimes because of the ruling in United States v. Jones, 132 S. Ct. 945 (2012). Rather, instead of using the GPS tracking data they had collected (illegally), the police decided to use Cell Site Location Information (CSLI). Jeffrey's previous article can be found here - Jones II: This time, the government seeks to use cell site location information.  If you're looking to read more on the subject, we have additional content that can be found, here.

On Monday, the Electronic Frontier Foundation filed an amicus brief in favor of Antoine Jones, arguing that six months worth of CSLI should not be obtainable without a warrant. The EFF drew parallels between this situation and the GPS tracking that occurred in the original instance. Additionally, the EFF forwards an argument in the brief that could not be used in the context of GPS tracking - that CSLI could actually provide information about occurrences inside the home. This is important because courts have tended to give the most Fourth Amendment protection to the confines of a private home - see, for example, Karo or Kyllo.

The EFF's brief also addresses third-party doctrine, the Stored Communications Act, and even CALEA.

The brief can be found here: BRIEF AMICI CURIAE OF THE ELECTRONIC FRONTIER FOUNDATION AND CENTER FOR DEMOCRACY & TECHNOLOGY IN SUPPORT OF DEFENDANT ANTOINE JONES’ MOTION TO SUPPRESS CELL SITE DATA


The EFF also has a story, here: Government Faces New Warrantless Surveillance Battle After Losing Landmark GPS Tracking Case

Read More