Massive round-up of new law articles, covering privacy, Fourth Amendment, GPS, cell site, cybercrime, big data, revenge porn, drones, and more

Spencer, Shaun B., The Surveillance Society and the Third-Party Privacy Problem (2013). South Carolina Law Review, Vol. 65, No. 2, 2013. Abstract: 

This Article examines a question that has become increasingly important in the emerging surveillance society: Should the law treat information as private even though others know about it? This is the third-party privacy problem. Part II explores two competing conceptions of privacy — the binary and contextual conceptions. Part III describes two features of the emerging surveillance society that should change the way we address the third-party privacy problem. One feature, “surveillance on demand,” results from exponential increases in data collection and aggregation. The other feature, “uploaded lives,” reflects a revolution in the type and amount of information that we share digitally. Part IV argues that the binary conception cannot protect privacy in the surveillance society because it fails to account for the new realities of surveillance on demand and uploaded lives. Finally, Part V illustrates how courts and legislators can implement the contextual conception to deal with two emerging surveillance society problems — facial recognition technology and geolocation data.

Kimberly N. Brown, Anonymity, Faceprints, and the Constitution, 21 Geo. Mason L. Rev. (forthcoming Winter 2014).

Jane Bambauer, Is Data Speech?, 66 Stan. L. Rev. 57 (2014). Abstract:

Privacy laws rely on the unexamined assumption that the collection of data is not speech. That assumption is incorrect. Privacy scholars, recognizing an imminent clash between this long-held assumption and First Amendment protections of information, argue that data is different from the sort of speech the Constitution intended to protect. But they fail to articulate a meaningful distinction between data and other more traditional forms of expression. Meanwhile, First Amendment scholars have not paid sufficient attention to new technologies that automatically capture data. These technologies reopen challenging questions about what “speech” is. 

This Article makes two overdue contributions to the First Amendment literature. First, it argues that when the scope of First Amendment coverage is ambiguous, courts should analyze the government’s motive for regulating. Second, it highlights and strengthens the strands of First Amendment theory that protect the right to create knowledge. Whenever the state regulates in order to interfere with the creation of knowledge, that regulation should draw First Amendment scrutiny. 

In combination, these claims show clearly why data must receive First Amendment protection. When the collection or distribution of data troubles lawmakers, it does so because data has the potential to inform and to inspire new opinions. Data privacy laws regulate minds, not technology. Thus, for all practical purposes, and in every context relevant to privacy debates, data is speech.

Elizabeth E. Joh, Privacy Protests: Surveillance Evasion and Fourth Amendment Suspicion, 55 Ariz. L. Rev. 997 (2014). Abstract:

The police tend to think that those who evade surveillance are criminals. Yet the evasion may only be a protest against the surveillance itself. Faced with the growing surveillance capacities of the government, some people object. They buy “burners” (prepaid phones) or “freedom phones” from Asia that have had all tracking devices removed, or they hide their smartphones in ad hoc Faraday cages that block their signals. They use Tor to surf the internet. They identify tracking devices with GPS detectors. They avoid credit cards and choose cash, prepaid debit cards, or bitcoins. They burn their garbage. At the extreme end, some “live off the grid” and cut off all contact with the modern world. 

These are all examples of what I call privacy protests: actions individuals take to block or to thwart government surveillance for reasons unrelated to criminal wrongdoing. Those engaged in privacy protests do so primarily because they object to the presence of perceived or potential government surveillance in their lives. How do we tell the difference between privacy protests and criminal evasions, and why does it matter? Surprisingly scant attention has been given to these questions, in part because Fourth Amendment law makes little distinction between ordinary criminal evasions and privacy protests. This Article discusses the importance of these ordinary acts of resistance, their place in constitutional criminal procedure, and their potential social value in the struggle over the meaning of privacy.

Conor M. Reardon, Cell Phones, Police Recording, and the Intersection of the First and Fourth Amendments, 63 Duke Law Journal 735-779 (2013). Abstract:

In a recent spate of highly publicized incidents, citizens have used cell phones equipped with video cameras to record violent arrests. Oftentimes they post their recordings on the Internet for public examination. As the courts have recognized, this behavior lies close to the heart of the First Amendment. 

But the Constitution imperfectly protects this new form of government monitoring. Fourth Amendment doctrine generally permits the warrantless seizure of cell phones used to record violent arrests, on the theory that the recording contains evidence of a crime. The Fourth Amendment inquiry does not evaluate a seizing officer’s state of mind, permitting an official to seize a video for the very purpose of suppressing its contents. Moreover, Supreme Court precedent is typically read to ignore First Amendment interests implicated by searches and seizures. 

This result is perverse. Courts evaluating these seizures should stop to recall the Fourth Amendment’s origins as a procedural safeguard for expressive interests. They should remember, too, the Supreme Court’s jurisprudence surrounding seizures of obscene materials—an area in which the Court carefully shaped Fourth Amendment doctrine to protect First Amendment values. Otherwise reasonable seizures can become unreasonable when they threaten free expression, and seizures of cell phones used to record violent arrests are of that stripe. Courts should therefore disallow this breed of seizure, trusting the political branches to craft a substitute procedure that will protect law-enforcement interests without doing violence to First Amendment freedoms.

Elizabeth Friedler, Protecting the Innocent—the Need to Adapt Federal Asset Forfeiture Laws to Protect the Interests of Third Parties in Digital Asset Seizures, Cardozo Arts & Entertainment Law Journal, Volume 32, Issue 1 (2013).

Jana Sutton, Of Information, Trust, and Ice Cream: A Recipe for a Different Perspective on the Privacy of Health Information, 55 Ariz. L. Rev. 1171 (2014). Abstract:

The concept of privacy is inescapable in modern society. As technology develops rapidly and online connections become an integral part of our daily routines, the lines between what may or may not be acceptable continue to blur. Individual autonomy is important. We cannot, however, allow it to suffocate the advancement of technology in such vital areas as public health. Although this Note cannot lay out detailed instructions to balance the desire for autonomy and the benefits of free information, it attempts to provide some perspective on whether we are anywhere close to striking the right balance. When the benefits of health information technology are so glaring, and yet its progress has been so stifled, perhaps we have placed far too much value—at least in the health care context—on individual privacy.

Kevin S. Bankston & Ashkan Soltani, Tiny Constables and the Cost of Surveillance: Making Cents Out of United States v. Jones, 123 YALE L.J. ONLINE 335 (2014). Abstract:

In United States v. Jones, five Supreme Court Justices wrote that government surveillance of one’s public movements for twenty-eight days using a GPS device violated a reasonable expectation of privacy and constituted a Fourth Amendment search. Unfortunately, they didn’t provide a clear and administrable rule that could be applied in other government surveillance cases. In this Essay, Kevin Bankston and Ashkan Soltani draw together threads from the Jones concurrences and existing legal scholarship and combine them with data about the costs of different location tracking techniques to articulate a cost-based conception of the expectation of privacy that both supports and is supported by the concurring opinions in Jones.

Schmitt, Michael N. and Vihul, Liis, The International Law of Attribution During Proxy 'Wars' in Cyberspace (January 30, 2014). 1 Fletcher Security Review (2014 Forthcoming). Abstract:

The article examines the use of non-State actors by States to conduct cyber operations against other States. In doing so, it examines attribution of a non-State actor's cyber operations to a State pursuant to the law of State responsibility, attribution of a non-State actor's cyber armed attack to a State for the purposes of a self-defense analysis, and attribution of cyber military operations to a State in the context of determining whether an international armed conflict has been initiated. These three very different legal inquiries are often confused with each other. The article seeks to deconstruct the issue of attribution into its various normative components.

Kate Crawford & Jason Schultz, Big Data and Due Process: Toward a Framework to Redress Predictive Privacy Harms, 55 B.C. L. Rev. 93 (2014). Abstract:

The rise of “Big Data” analytics in the private sector poses new challenges for privacy advocates. Through its reliance on existing data and predictive analysis to create detailed individual profiles, Big Data has exploded the scope of personally identifiable information (“PII”). It has also effectively marginalized regulatory schema by evading current privacy protections with its novel methodology. Furthermore, poor execution of Big Data methodology may create additional harms by rendering inaccurate profiles that nonetheless impact an individual’s life and livelihood. To respond to Big Data’s evolving practices, this Article examines several existing privacy regimes and explains why these approaches inadequately address current Big Data challenges. This Article then proposes a new approach to mitigating predictive privacy harms—that of a right to procedural data due process. Although current privacy regimes offer limited nominal due process-like mechanisms, a more rigorous framework is needed to address their shortcomings. By examining due process’s role in the Anglo-American legal system and building on previous scholarship about due process for public administrative computer systems, this Article argues that individuals affected by Big Data should have similar rights to those in the legal system with respect to how their personal data is used in such adjudications. Using these principles, this Article analogizes a system of regulation that would provide such rights against private Big Data actors.

Larkin, Paul J., 'Revenge Porn,' State Law, and Free Speech (January 14, 2014).  Abstract:

For most of our history, only celebrities — presidents, movie stars, professional athletes, and the like — were at risk of having their everyday exploits and activities photographed and shown to the world. But that day is gone. Today, we all face the risk of being made into a celebrity due to the ubiquity of camera-equipped cell phones and the ease of uploading photographs or videos onto the Internet. But a particularly troubling aspect of this phenomenon goes by the name of "revenge porn" — that is, the Internet posting of photographs of naked former wives and girlfriends, sometimes in intimate positions or activities. Revenge porn is an example of malicious conduct that injures the welfare of someone who mistakenly trusted an intimate partner. Tort law traditionally has allowed parties to recover damages for such violations of privacy, and criminal law also can prohibit such conduct, but there are several First Amendment defenses that the responsible parties can assert to fend off liability. This article argues that allowing a victim of revenge porn to recover damages for publication that breaches an implicit promise of confidentiality is faithful to tort and criminal law principles and will not punish or chill the legitimate expression of free speech.

Jonathan Olivito, Beyond the Fourth Amendment: Limiting Drone Surveillance Through the Constitutional Right to Informational Privacy, 74 Ohio St. L.J. 669 (2013). 

The entirety of Volume 74, Issue 6 in the Ohio State Law Journal; Symposium: The Second Wave of Global Privacy Protection (Titles Below)

Peter Swire, The Second Wave of Global Privacy Protection: Symposium Introduction, 74 Ohio St. L.J. 841 (2013). 

Ann Bartow, Privacy Laws and Privacy Levers: Online Surveillance Versus Economic Development in the People’s Republic of China, 74 Ohio St. L.J. 853 (2013). 

Andrew Clearwater & J. Trevor Hughes, In the Beginning . . . An Early History of the Privacy Profession, 74 Ohio St. L.J. 897 (2013). 

Claudia Diaz, Omer Tene & Seda Gürses, Hero or Villain: The Data Controller in Privacy Law and Technologies, 74 Ohio St. L.J. 923 (2013). 

A. Michael Froomkin, “PETs Must Be on a Leash”: How U.S. Law (and Industry Practice) Often Undermines and Even Forbids Valuable Privacy Enhancing Technology, 74 Ohio St. L.J. 965 (2013). 

Woodrow Hartzog, Social Data, 74 Ohio St. L.J. 995 (2013). 

Dennis D. Hirsch, In Search of the Holy Grail: Achieving Global Privacy Rules Through Sector-Based Codes of Conduct, 74 Ohio St. L.J. 1029 (2013). 

Gus Hosein & Caroline Wilson Palow, Modern Safeguards for Modern Surveillance: An Analysis of Innovations in Communications Surveillance Techniques, 74 Ohio St. L.J. 1071 (2013). 

Anil Kalhan, Immigration Policing and Federalism Through the Lens of Technology, Surveillance, and Privacy, 74 Ohio St. L.J. 1105 (2013). 

Bartosz M. Marcinkowski, Privacy Paradox(es): In Search of a Transatlantic Data Protection Standard, 74 Ohio St. L.J. 1167 (2013). 

Thomas Margoni & Mark Perry, Deep Pockets, Packets, and Harbors, 74 Ohio St. L.J. 1195 (2013). 

Omer Tene, Privacy Law’s Midlife Crisis: A Critical Assessment of the Second Wave of Global Privacy Laws, 74 Ohio St. L.J. 1217 (2013). 

Yofi Tirosh & Michael Birnhack, Naked in Front of the Machine: Does Airport Scanning Violate Privacy? 74 Ohio St. L.J. 1263 (2013). 

Yang Wang, Pedro Giovanni Leon, Xiaoxuan Chen, Saranga Komanduri, Gregory Norcie, Kevin Scott, Alessandro Acquisti, Lorrie Faith Cranor & Norman Sadeh, From Facebook Regrets to Facebook Privacy Nudges, 74 Ohio St. L.J. 1307 (2013). 

Tal Z. Zarsky & Norberto Nuno Gomes de Andrade, Regulating Electronic Identity Intermediaries: The “Soft eID” Conundrum, 74 Ohio St. L.J. 1335 (2013).

The entirety of Volume 14, Issue 1 of the  Journal of High Technology Law (2014) (Titles Below).

After Jones, The Deluge: The Fourth Amendment's Treatment Of Information, Big Data And The Cloud , Lon A. Berk, 14 J. High Tech L. 1 (2014). 

The Legislative Response To Employers' Requests For Password Disclosure, Jordan M. Blanke, 14 J. High Tech L. 42 (2014). 

A Shot In The Dark: An Analysis Of The SEC's Response To The Rise Of Dark Pools Edwin Batista, 14 J. High Tech L. 83 (2014). 

Privacy Protections Left Wanting: Looking At Doctrine And Safeguards On Law Enforcements' Use Of GPS Tracking And Cell Phone Records With A Focus On Massachusetts, Lloyd Chebaclo, 14 J. High Tech L. 120 (2014).

Read More

Featured Paper: Siri, Can You Keep a Secret? A Balanced Approach to Fourth Amendment Principles and Location Data

Frank Lin, a 3L at the University of Oregon, has a new law review article out entitled "Siri, Can You Keep a Secret? A Balanced Approach to Fourth Amendment Principles and Location Data."

I asked him to comment on his motivation for the article and he responded as follows:

I was drawn to this topic because privacy is one of the most important issues facing the American public today and it is one that has recently come to the forefront of public policy discourse. The rapid development and accessibility of technology has allowed Americans to reach new levels of interconnectivity. The implication of this is that, whether intentional or not, more details about our lives are being shared with public and private actors. The application of Fourth Amendment protection in a world where our access to privacy is quickly evolving poses a challenge for courts and law enforcement, especially in the context of location data. To this end, I wanted to advocate for an approach that is easily applicable, and more importantly, one that balances legitimate government interests and privacy concerns of the People.

An excerpt from his introduction:

The Fourth Amendment to the United States Constitution provides the right for “people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” Underlying this phrase are guiding principles that have deep roots reaching as far as the Roman Empire. For instance, Roman statesman Cicero stated, “[w]hat is more inviolable . . . than the house of a citizen[?] . . . This place of refuge is so sacred to all men, that to be dragged from thence is unlawful.” 

But how do historic principles apply to modern society? The Fourth Amendment traditionally protected papers located in homes or in luggage. Today, however, information is no longer constrained to fading parchment. Information and methods of communication have transcended into a digital era, where ideas and beliefs reside in computer systems in distant locations that are maintained by third parties. Thus, it is not always clear how the Fourth Amendment applies to the information age.
…
Some worry that law enforcement’s use of location data can pose an objective harm, as they fear that the government will subject the public to non-stop surveillance. Judge Flaum from the Seventh Circuit noted that “[t]he constitutional ill of prolonged or mass use of GPS technology would not necessarily be based on the information acquired by the device but on the fact of the government’s gaze.” 

The legality of law enforcement’s use of location data remains ambiguous in the absence of clear direction from either the judiciary or the legislature. Further, the majority of the existing scholarship on the subject remains unworkably vague and hostile toward the government’s use of location data to aid in the investigation and prosecution of crime. This Comment proposes a standard for government access to location data that is not only practical, but also one that balances the legitimate interests of law enforcement and the privacy concerns of citizens. 

Read More

EFF files amicus brief in Massachusetts cell site data case

The Electronic Frontier Foundation recently filed an amicus brief in a Massachusetts appellate case regarding cell site location data. The trial court in Commonwealth v. Augustine had suppressed two weeks' worth of cell site data, finding that a search warrant was necessary to obtain it. The government then appealed.

According to the EFF release:

In our amicus brief, we urge the SJC to affirm the trial court, arguing that people maintain a reasonable expectation of privacy in their location—even their public movements—since society would deem it unlikely that anything more than small, discrete movements would be observed at a time.... 

Even the SJC itself has been a leader on location privacy. Earlier this year, it ruled in Commonwealth v. Rousseau that a passenger in a car had standing to challenge GPS surveillance because everyone, regardless of whether they are the car's owner or not, has an expectation of privacy in their location.

We hope that the SJC will extend Rousseau, recognize that the third party doctrine does not apply to invasive cell site monitoring, and require police obtain a search warrant to track a person's location through their cell phone.

Read the EFF amicus brief by clicking here.

Read More

Featured Paper: Upcoming law review article addresses cell tower dumps and the Fourth Amendment

A recently accepted article in the University of Pennsylvania Journal of Constitutional Law addresses the use of cell tower dumps by law enforcement. A tower dump allows police to request the phone numbers of all phones that connected to a specific tower within a given period of time (see a prior post about the type of process needed for tower dumps here).

The article by Texas Tech Visiting Assistant Professor Brian Owsley, "The Fourth Amendment Implications of the Government's Use of Cell Tower Dumps in its Electronic Surveillance", is an excellent look at this little-known but widely used technology and the legal issues arising therefrom. Here's the abstract:

Privacy concerns resonate with the American people. Although the right to privacy is not explicitly protected in the United States Constitution, the Supreme Court has found the right to privacy rooted within the Constitution based on various amendments. In the modern era, with rapid advances in technology, threats to privacy abound including new surveillance methods by law enforcement. There is a growing tension between an individual’s right to privacy and our collective right to public safety. This latter right is often protected by law enforcement’s use of electronic surveillance as an investigative tool, but may be done at times inconsistent with constitutional rights.

Recently, the American Civil Liberties Union brought to light the popular use of government surveillance of cell phones, including the gathering of all cell phone numbers utilizing a specific cell site location. Known as a “cell tower dump,” such procedures essentially obtain all of the telephone number records from a particular cell site tower for a given time period: “A tower dump allows police to request the phone numbers of all phones that connected to a specific tower within a given period of time.” State and federal courts have barely addressed cell tower dumps. However, the actions by most of the largest cell phone providers, as well as personal experience and conversations with other magistrate judges, strongly suggest “that it has become a relatively routine investigative technique” for law enforcement officials.

No federal statute directly addresses whether and how law enforcement officers may seek a cell tower dump from cellular telephone providers. Assistant United States Attorneys, with the encouragement of the United States Department of Justice, apply for court orders authorizing cell tower dumps pursuant to a provision in the Electronic Communications Privacy Act of 1986. The pertinent provision poses a procedural hurdle less stringent than a warrant based on probable cause, which in turn raises significant constitutional concerns.

This article provides a brief description of cellular telephone and cell-site technology in Part I. Next, Part II addresses the evolution of Fourth Amendment jurisprudence and argues that the reasonable expectation of privacy standard applies to electronic surveillance such as cell tower dumps. In Part III, the discussion follows the development of statutes addressing electronic surveillance and argues that cell tower dumps request more information than simply just telephone numbers. Part IV analyzes records from both cellular service providers and the federal government to conclude that cell tower dumps routinely occur. Part V assesses the few decisions that even discuss cell tower dumps and argues that the analysis is either non-existent or flawed regarding the use of the Stored Communications Act to permit cell tower dumps. Next, Part VI asserts that cell tower dumps cannot be analyzed pursuant to the Stored Communications Act because the language of the statute is inapplicable and the amount of information sought requires a warrant based on probable cause and concludes by proposing some protocols to safeguard individual privacy rights.

Read More

New Jersey Supreme Court holds that police must get warrant for cell site data

In State v. Earls, No. 068765 (N.J. 2013), the Supreme Court of New Jersey held that police must obtain a warrant in order to get cell site location information (CSLI) unless an exception to the warrant requirement applies.

During the investigation of several burglaries, police contacted - without a warrant - T-Mobile at three different times in one evening to obtain cell site data for the defendant's cell phone. The trial court found that the defendant had a reasonable expectation of privacy in the location of his cell phone and a warrant should have been obtained. However, they further found that the emergency aid exception to the warrant requirement applied. The defendant pled guilty.

On appeal, the intermediate appellate court found that the "defendant had no constitutionally protected privacy interest" because he had "no reasonable expectation of privacy in [his] movements on public highways or the general location of [his] cell phone."

In its decision, the Supreme Court disagreed with the Appellate Division, noting that the state's constitution provides greater protection than the Fourth Amendment and finding that police must obtain a warrant before acquiring CSLI.

[P]eople do not buy cell phones to serve as tracking devices or reasonably expect them to be used by the government in that way. We therefore find that individuals have a reasonable expectation of privacy in the location of their cell phones under the State Constitution.

However, the court noted that recognized exceptions are still applicable and thus remanded to the Appellate Division for consideration of the emergency aid doctrine or other warrant exceptions.

Read More

Maryland appeals court reverses conviction due to lay witness testimony connecting defendant to crime scene with CSLI

In a recent Maryland case, the Court of Special Appeals found that it was improper for the trial court to use lay testimony from a detective to suggest that the defendant's cell phone was in close proximity to the location of the crime. Because the detective was not presented as an expert witness on the technology, the testimony was improper, and the conviction was reversed and remanded. Payne v. State, No. 2156 (Md. Ct. Spec. App. 2013).

The defendant had been charged and convicted of first-degree felony murder. At trial, the detective testified as to how he was able to use call records to find the cell tower in which the defendant's phone was connected at the time of the call. Defense counsel objected, arguing that the detective was "offering expert testimony without a proper foundation." The detective was allowed to testify without the proper foundation.

On appeal, the defendant argued that the cell site location information should not have been allowed from a lay witness. The state countered, "there was no 'opinion' testimony, lay or otherwise, in this case and, even if it did constitute opinion testimony, there was no need for the State to produce an expert to testify regarding the facts relating to appellants' cell phone records."

Ultimately, here's what caused the appeals court to take issue with the testimony:

Subsequent to the court's ruling, Detective Edwards testified that a telephone call from Bond's cell phone registered off of a cellular tower "at a latitude and longitude of 39.350854 by negative 76.696565 located on Menlo Drive" which was approximately one and one half to two miles away from the crime scene at approximately the time when the crime occurred. At approximately 1:00 a.m. on August 27, 2007, another call had been placed from Bond's cell phone registering off of a cellular tower at latitude and longitude 39.34364 by negative 76.72851, a location known as Balmoral Towers, located approximately one mile from the crime scene. Over objection, Detective Edwards then identified the map which has been generated as a mapping program that depicted the aforesaid locations. Finally, Detective Edwards testified that Paynes' cellular-phone activated off of one of the towers located in proximity to the crime scene at 10:02 a.m. on August 26, 2007.

Because the testimony was improperly allowed by a lay witness, it was in error. The court found the testimony to be "critical," and thus reversed and remanded the case.

Read More

Quick details on H.R. 983, the ECPA reform bill announced today

From House Representative Zoe Lofgren's release:

Reps. Zoe Lofgren (D-San Jose), Ted Poe (R-TX) and Suzan DelBene (D-WA) today introduced bipartisan legislation modernizing the 1986 Electronic Communications Privacy Act (ECPA. Consumers and businesses are increasingly using cloud computing and location-based services, but the law has failed to keep pace with technology – leading to weak and convoluted privacy protections from government access to user data. The bill, H.R. 983, the Online Communications and Geolocation Protection Act, would strengthen the privacy of Internet users and wireless subscribers from overbroad government surveillance by requiring the government to get a warrant based on probable cause before intercepting or forcing the disclosure of electronics communications and geolocation data.

A copy of the bill can be found here: H.R. 983 - Online Communications and Geolocation Protection Act

A summary (section by section) of the major changes can be found here: H.R. 983 Summary of Changes 

The bill requires, inter alia, a warrant for GPS tracking and CSLI tracking, with limited exceptions (FISA, emergency, consent, etc.). Another section from the Rep. Lofgren's release sums it up nicely:

Rep. Lofgren's Online Communications and Geolocation Protection Act would apply Constitutional privacy guarantees under the Fourth Amendment to an individual's digital communications and location data while minimizing the impact on law enforcement investigations. The bill would: 

Require the government to obtain a warrant to access to wire or electronic communications content; 

Require the government to obtain a warrant to intercept or force service providers to disclose geolocation data; 

Preserve exceptions for emergency situations, foreign intelligence surveillance, individual consent, public information, and emergency assistance; 

Prohibit service providers from disclosing a user's geolocation information to the government in the absence of a warrant or exception;

Prohibit the use of unlawfully obtained geolocation information as evidence; 

Provide for administrative discipline and a civil cause of action if geolocation information is unlawfully intercepted or disclosed.

Read More

Jones II: District court holds that SCA's lack of suppression remedy and the good faith exception allows admission of CSLI

In the continuing saga of the case against Antoine Jones, the DC district court has held that the use of Jones's cell site location information does not violate the Fourth Amendment. United States v. Jones, No. 05-0386 (D.D.C. 2012). In January, the Supreme Court ruled that location information acquired as a result of law enforcement placing a GPS device on Jones's car could not be used at trial as it violated the Fourth Amendment.

During the initial investigation, law enforcement obtained both GPS data and cell site data but only sought to use the GPS data at trial. After the Supreme Court's determination that such data could not be used, the government sought to have CSLI introduced at Jones's retrial. The four months of cell site information had been obtained from Cingular Wireless under a 2703(d) order pursuant to the Stored Communications Act in 2005.

Jones's first motion to suppress argument was that prospective CSLI data (that which is acquired by the phone company after the order is issued rather than seeking "historical" data already obtained) cannot be obtained under the SCA without probable cause. The court held that a majority of courts have agreed, but the argument is irrelevant because the SCA does not provide a suppression remedy. Thus, regardless of a successful argument, the data would still be admissible under the SCA.

Of course, Jones's second argument was under the Fourth Amendment, which if successful would allow for suppression. The court thoroughly examined the different approaches for analyzing the Fourth Amendment's application to orders to obtain CSLI. However, the court declined to decide the issue, finding that the good-faith exception would apply, reasoning that at the time the order was obtained, the officers had no way of knowing how future courts would rule on prospective CSLI, and even today, the issue is not settled.

Read More

Mass. trial court finds obtaining one day of CSLI without cause to violate the Mass. Constitution

In Commonwealth v. Wyatt, 30 Mass. L. Rep. 270 (Mass. Sup. Ct. 2012), the Superior Court of Massachusetts held that obtaining cell site location information (CSLI) without a showing of cause (the court did not specify if probable cause was a requirement) was a violation of the Massachusetts Constitution. As a result of this finding, the defendants' motions to suppress were granted.

As part of a murder investigation, law enforcement acquired nine 2703(d) orders covering five different cell phone companies and eighteen phone numbers seeking subscriber information and call records for a near two-month period and CSLI for one day. Officers later admitted they did not have probable cause to acquire this information. The four defendants filed a motion to suppress their historical CSLI .

The court began by discussing the similarities of cell phones and a GPS device, noting that "CSLI enables a cellular telephone to be treated as a de facto Global Positioning System (GPS) tracking device." As such, they conducted an evaluation of a state high court opinion in Connolly (holding that installation of a GPS device on a vehicle is a seizure) and the Supreme Court's opinion in Jones.

Next, the court applied the expectation of privacy test to the use of CSLI. Because "[i]t is unlikely that the average cellular telephone user knows that when he or she makes or receives a call or a text message, the service provider creates and maintains a record of the cellular telephone’s location," the defendants had a subjective expectation of privacy in the cell records.

As to an objective expectation of privacy, the court held:

Allowing the government to track our movements without evidence that the person whose CSLI is sought engaged in criminal activity compromises what it means to be a citizen of the United States of America free from arbitrary surveillance.... 

Allowing the government to track a citizen’s movement through CSLI, without requiring the government to show probable cause or even reasonable suspicion that the target is engaged in criminal activity is contrary to the very freedom we hold dear.

Thus, the defendant's motion to suppress their cell site location information was granted.

Cybercrime Review blogger Justin Webb contributed to this post.

Read More

Analysis of Fifth Circuit CSLI oral argument: Government likely to win on Fourth Amendment issue

The Fifth Circuit heard oral argument yesterday on the oft-discussed cell site data case. The Fives are the second federal court of appeals to consider this issue; the Third Circuit addressed cell site data in relation to the Fourth Amendment in 2010.

The issues presented in this case are two-fold: first, whether the Constitution requires a warrant based on probable cause (rather than a court order issued under a lesser standard provided by § 2703(d) of the Stored Communications Act) when the Government wants cell phone providers to turn over data showing the location of the cell phone. In other words, the issue is whether the Government needs to have probable cause to turn cell phones into semi-specific tracking devices. The second issue is, assuming that cell site data is not protected by the Fourth Amendment, whether the magistrate judge has discretion to deny the Government’s § 2703(d) application for this data and insist upon a showing of probable cause.

The argument in this case was an hour long, much longer than the customary forty minutes usually allotted to parties arguing before the Fifth Circuit. The extra time may have been a result of the truly bizarre procedural posture of this case. According to the Government, it presented “specific and articulable facts” pursuant to § 2703(d) of the Stored Communications Act that the cell phone numbers of three people were pertinent to criminal investigations. The magistrate judge, however, never granted or denied the Government’s § 2703(d) applications; and, instead, ruled that this data was protected by the Fourth Amendment and that the Government needed probable cause to obtain it. Thus, the Government’s argument was presented by Nathan Judish, an attorney from the Department of Justice. There was no traditional appellee represented at oral argument; the people whose cell site data the Government was trying to obtain are anonymous, so there was no one with a direct, personal interest in the outcome of this case advocating for Fourth Amendment protection. Instead, Professor Susan Freiwald and Hanni Fakhoury (EFF) presented the arguments of the “Fourth Amendment and the people,” whatever that means.

The three-judge panel appointed to hear oral arguments were Fifth Circuit Judges Thomas Reavley, Edith Clement, and James Dennis. Interestingly enough, this was a liberal-majority panel in a notoriously conservative circuit. Judge Reavley was appointed by the Carter administration, and Judge Dennis was appointed by the Clinton administration. A liberal-majority panel on the Fifth Circuit is like the Loch Ness Monster: there are reports of people seeing it happen, but I have always figured that it was a myth propagated by circus conductors and the ACLU.

When I saw the membership of the panel, my first instinct was that the panel would render a 2-1 decision holding that cell site data is protected by the Fourth Amendment. I figured that Judges Reavley and Dennis would make up the majority, and Judge Clement would be the lone dissenter. After hearing oral argument, I do not think my prediction could be more wrong. I think the majority of the panel will hold that this data is not protected by the Fourth Amendment, Judge Reavley (and possibly Judge Dennis) siding with Judge Clement.

Why do I think this?

First, the judges struggled to understand the technology. When I read the briefs, I was astounded that they were not written with the understanding that these judges were not going to have an innate understanding of rather complicated cell phone technology. The judges on the panel ranged in age from sixty-four to ninety-one. I think it is safe to assume that they know how to use a cell phone, or at least, they have seen one of their law clerks use a cell phone at some point. Any imputed knowledge beyond that, i.e., the definition of a femtocell, is ludicrous. A number of the panel’s questions were geared toward trying to understand basic cell site technology, and I can see why. The Government’s brief does not define “cell site data” until page seven. Then, once you get to page seven, the Government defines cell site data as “the antenna tower and sector to which the cell phone sends its signal.” Now, imagine you are speaking to your grandmother and that is how you explain the concept of cell site data to her. Is she going to have any idea what you are talking about? I think not. I would offer the non-scientific estimate that at least a third of the questions during oral argument related to the basic tenets of the technology involved. These questions should have been addressed within the first five pages of the parties’ briefs; yet I doubt whether the panel understands the technology and the type of information being produced, even after oral argument. Ultimately, the real shortfalling is on the amici who were trying to convince the court that revelation of this data to the Government amounted to a significant intrusion into privacy. If the court cannot understand how cell phone technology works and why consumers have a privacy interest in this data, the Fifth Circuit cannot hold that cell site data is protected by the Fourth Amendment.

Second, there was no definite explanation about what kind of data would be produced as a result of these § 2703(d) applications. Judge Reavley told the parties, “It is critical to know exactly what information is being obtained in these . . . cases.” Yet, he received two different answers during oral argument. The Government mumbled something about call-times and cell phone towers; Professor Susan Freiwald and Hanni Fakhoury painted a picture that was positively Orwellian with the Government determining location of the cell phone within fifty feet, even when the cell phone was turned off. It is clear that the court did not have access to the § 2703(d) applications prior to oral argument and has no understanding whatsoever what type of data will be revealed if the applications are granted. Perhaps things will be clearer after an over-worked, under-paid law clerk receives the applications along with the case record after oral argument. But, as of oral argument, it is clear that only the Government was privy to this information, and the Department of Justice was less than forthcoming.

Third, the panel asked no questions during the time the parties were discussing the Fourth Amendment. This generally indicates a lack of interest. Also, Judge Reavley stated during oral argument, “I just don’t see us announcing a law that you have to have a probable cause showing from a magistrate under this statute. Period.”

One thing I found very interesting about argument was the judges’ constant questions to the parties about how they can avoid the Fourth Amendment issue altogether. Judge Clement raised a very good point during oral argument asking the Government whether the issue in the case was moot. The Government filed these § 2703(d) applications in 2010. Although the Government’s attorney assured the court that the criminal investigations were ongoing, I think Judge Clement found this doubtful. To my knowledge, however, the Fifth Circuit has no way of assuring that this case is not moot, and the Government is still pursuing these criminal investigations. Ultimately, the Fives’ continued jurisdiction over this matter rests upon the Government’s pinky swear that these criminal investigations abide. Oy vey.

Although the Government is likely to win the Fourth Amendment argument, I think the Fifth Circuit will hold that it is within a magistrate judge’s discretion to reject an application for cell site location information which would therefore impose a probable cause requirement to obtain the data. This is the result reached by the Third Circuit, and the judges seemed hesitant to create a circuit split.

So, my trepidatious prediction, based on oral argument, is that the parties will split the baby: cell site data, at least in its current iteration, is not protected by the Fourth Amendment, but there are certain situations where a magistrate judge can insist upon a showing of probable cause when considering a § 2703(d) application. If the case does reach the Fourth Amendment issue, I would not be surprised that there are some subsequent rumblings about an en banc vote.

Read More

Oral argument posted in Fifth Circuit cell site case

Below is a link to the oral arguments in the Fifth Circuit cell site location information case I blogged about on Monday. Arguments were presented by Nathan Judish from the DOJ, Professor Susan Freiwald, and Hanni Fakhoury of the EFF. We'll have analysis of the arguments soon.

http://www.ca5.uscourts.gov/OralArgRecordings/11/11-20884_10-2-2012.wma

Read More

Fifth Circuit to hear cell site data case Tuesday

Tomorrow, the Fifth Circuit will hold oral arguments for its much anticipated case on cell site location information. A magistrate judge denied the government's 2703(d) request for 60 days of location data, holding that a search warrant was needed. The district court judge agreed, and the government appealed.

The predominant issue in the case is whether CLSI is protected by the Stored Communications Act alone or also by the Fourth Amendment. If it's only the former, law enforcement need only show "specific and articulable facts," rather than the higher standard of probable cause required by the Fourth Amendment. Because, the government argues, the data is held by a third party, the Fourth Amendment does not apply.

The case is In Re: Application of the United States of America for Historical Cell Site Data (No. 11-20884).

Here's a list of court filings in the case:

• Government's Brief
• Professor Orin Kerr's Amicus (arguing the question is not ripe)
• Professor Susan Freiwald's Amicus
• EPIC's Amicus
• ACLU, EFF, CDT, and NACDL Amicus
• Government's Reply Brief

And here are a commentary links on the case:

• Magistrate Judge Smith's defense of his decision
• Professor Kerr - Here, here, here, here, here, and here
• Professor Freiwald

I'll post a link to the oral argument once the recording is available.

Read More

Jones II: DOJ files opposition to motion to suppress Jones's cell site data

Several months back, I mentioned that Antoine Jones, the defendant in the Supreme Court's Jones decision, is back in trial court after the high court's remand. The DOJ is now seeking to do with cell site data what it is not allowed to do with GPS information.

On Tuesday, the government filed its opposition to Jones's motion to suppress.

Here's the summary of the government's argument:

Defendant’s motion to suppress cell-site location records cannot succeed under any theory. To begin with, no reasonable expectation of privacy exists in the routine business records obtained from the wireless carrier in this case, both because they are third-party records and because in any event the cell-site location information obtained here is too imprecise to place a wireless phone inside a constitutionally protected space.  Even if defendant were able to establish a Fourth Amendment privacy interest, the government’s good-faith reliance upon judicial and statutory authorization here forecloses any claim for suppression.  

Finally, defendant expressly admits that the government lawfully relied upon the proper legal authority – 18 U.S.C. § 2703(d) – to obtain the disputed records. To the extent that defendant alleges that the government violated this (or other) statutes, his motion fails because no statutory suppression remedy is available. As a result, defendant’s motion must be denied.

The case is before the DC federal district court. The Electronic Frontier Foundation's brief is available here, and Jones' motion can be found here.

Read More

District Court denies motion to suppress cell site data

In United States v. Madison, 2012 U.S. Dist. LEXIS 105527 (S.D. Fla. 2012), the district court denied a motion to suppress cell site location information as the application contained facts asserting that the defendant was an associate of - and lived near - a known participant.

A 2703(d) order was obtained to get historical cell site records for the defendant after a shooting and other related crimes. To prove specific and articulable facts, law enforcement presented facts concerning the gunman they caught near the scene. They connected the defendant to the gunman with the following facts:

m. Sources have identified Bobby Ricky Madison as a person possibly involved in the armored car robbery that occurred on October 1, 2010. Madison is also a known associate of Moss and Moss's other associates. From document[s] regarding a prior arrest of Madison, the FBI has learned that Madison uses a cellular telephone assigned the number 754-234-7001. 

n. Madison lives in the Opa Locka area near where Moss resides. In May 2010, officers in the same Coconut Creek area from which the two stolen vehicles used in the October 1, 2010, robbery were stolen attempted to perform a traffic stop of a vehicle Madison was driving. He lead the officers on a high-speed car chase before eventually being apprehended. The car he was driving was reported stolen from that same Coconut Creek area at approximately the same time of day as the two vehicles used in the October 1, 2010, robbery.

Thus, the "specific and articulable facts" were that the defendant was a known associate and lived in the area (approximately eight miles away).

The court agreed that the application was sufficient. It presented facts surrounding the armed robbery, the defendant's ties to another participant, and his "skill set and modus operandi for stealing cars." Further, it alleged that at least three others were involved in the act, though only one had been found. As it was reasonable to believe the defendant's cell site data would be relevant and material to the investigation, the 2703(d) order was proper.

Read More

Report reveals 1.3 million requests for cell phone subscriber information in 2011

Rep. Ed Markey

For those who have assumed that requests for subscriber information from phone companies were minimal and that there was often no charge, a release of reports today shows just how pervasive and expensive these activities are. In July, Congressman Edward Markey (D-Mass.) requested figures from nine cell phone companies and revealed the information today.

Markey, first elected to the House in 1976, said of the findings, "We cannot allow privacy protections to be swept aside with the sweeping nature of these information requests, especially for innocent consumers."

In all, law enforcement made 1.3 million requests in 2011. Sprint estimates that it received 500,000 subpoenas in 2011 and has performed over 50,000 wiretaps in the last five years.

AT&T received over 260,000 requests last year including nearly 50,000 2703(d) orders and search warrants. The company has more than 100 full-time employees fulfilling these requests and charged over $8 million in 2011 alone.

The largest mobile phone provider in the country, Verizon, also received about 260,000 requests in 2011, about half from subpoenas. They claim that requests have grown about 15% per year over the past five years. Verizon has 70 employees working around the clock to meet law enforcement's demands.

The New York Times notes these figures may be severely underestimated in terms of requests and the number of subscribers involved:

Because of incomplete record-keeping, the total number of law enforcement requests last year was almost certainly much higher than the 1.3 million the carriers reported to Mr. Markey. Also, the total number of people whose customer information was turned over could be several times higher than the number of requests because a single request often involves multiple callers. For instance, when a police agency asks for a cell tower “dump” for data on subscribers who were near a tower during a certain period of time, it may get back hundreds or even thousands of names.

Full responses from the providers can be viewed on Congressman Markey's website.

Read More

Seton Hall L. Rev. publishes CSLI comment

If you're interested in the debate over cell site location information, a recently published comment by Christopher Fox in the Seton Hall Law Review will provide you with excellent background and analysis of the legal issues. Here's an excerpt:

Part II of this Comment will explain the process cell phones use for sending and receiving calls, messages, and information, as well as how CSLI data is computed to produce an approximate location of a cell phone. Part III will provide the relevant Fourth Amendment jurisprudence, explain the language and protections provided under the SCA, and examine the Third Circuit’s interpretation and application of the statute to a § 2703(d) order request. Part IV will argue that the Third Circuit’s cursory analysis of historic CSLI in light of the relevant Fourth Amendment jurisprudence was incorrect, and will highlight the resulting failure to set forth guidelines for § 2703(d) order requests that would end the application of discrepant standards. Finally, Part V will propose an amendment to the statute that will eliminate the current discrepancy and clarify the requirements for compelled disclosure of historic CSLI.

Click here for the comment.

A pending Fifth Circuit case also addresses the issue. Click here to read the briefs at Volokh Conspiracy. For recent events concerning CSLI from our blog, click here.

Read More

Congress investigates location data issues

House conducts hearing on GPS Act
A recent congressional hearing addressed the proposed Geolocational Privacy and Surveillance Act which would require a search warrant to obtain GPS or CSLI data from phone companies. The bill is authored by Rep. Jason Chaffetz (R-Utah) and Sen. Ron Wyden (D-Oregon).

John Ramsey, of the Federal Law Enforcement Officers Association, suggested that location data is often essential to obtaining a search warrant, and requiring a warrant for location data would make law enforcement's job more difficult. Ramsey suggested that the location data is nothing more than a corporate record and is undeserving of a special standard. (Other testimonies are available here.)

Franken requests DOJ practices
Senator Al Franken (D-Minn.), an outspoken privacy advocate, has requested from the Department of Justice a rundown of their practices for requesting location information directly from cell service providers.

I am eager to learn about how frequently the Department requests location information and what legal standard the Department believes it must meet to obtain it. I would also like to know how the Department may have changed these practices since the Jones decision.

Specifically, Franken asked how many requests the DOJ had made, what type of response was given, whether the data was historical or prospective, the legal process used, total cost, and Jones-related questions.

Read More

Court suppresses fruit of warrantless GPS tracking, but could inevitable discovery have saved it?

In United States v. Lee, 2012 U.S. Dist. LEXIS 71204 (E.D. Ky. 2012), the court ordered suppression of evidence obtained as part of an investigation using a GPS device installed without a search warrant. A later search was not sufficiently attenuated, and the use of GPS was not in good faith.

The defendant was suspected of drug trafficking, and a DEA officer installed a GPS device on his car without a search warrant. The device allowed them to track his movements, and the DEA notified state police of the investigation. State police were notified of the defendant's location and ultimately stopped the defendant for not wearing a seatbelt. During the stop, 150 pounds of marijuana was found.

The magistrate recommended suppression of the evidence, and the government objected, arguing "that the traffic stop was sufficiently attenuated from the illegal GPS search to expunge the taint of the illegal search, and even if it was not, that the officers acted in good faith."

Because of the timing, lack of intervening circumstances which might have severed the unconstitutional use of GPS, and the fact "that the police misconduct was guided by an impermissible purpose," the district court found that the stop was not sufficiently attenuated.

The court also refused to extend the good faith exception. In circuits that had allowed warrantless GPS prior to Jones, courts have been allowing the use of GPS data obtained prior to Jones (see previous post here). However, as the court noted, allowing the use of non-binding authority to support a good faith argument would allow officers to "beg forgiveness rather than ask permission in ambiguous situations involving . . . basic civil rights" (quoting United States v. Katzin, 2012 U.S. Dist. LEXIS 65677, (E.D. Pa. 2012)).

Possible Argument
An argument I think would be interesting in this type of situation would be inevitable discovery with CSLI. If the government could get the defendant's CSLI records showing his movement along the same route, they could have had the same result. Since CSLI data can be obtained with specific and articulable facts (rather than the higher probable cause standard), the government could show that if they had known the GPS use would be unconstitutional, they would have just used CSLI, still been able to track the defendant, and still found the pot. The pot, being derivative evidence, would likely be admissible. Some courts would not allow the GPS data itself to be admitted (as it's primary evidence), but it's not that important when you have 150 pounds of marijuana to prove your case.

Read More

What type of process is required for a cell tower dump?

I was recently in a discussion concerning the type of process needed for law enforcement to obtain a tower dump from a service provider. A tower dump allows police to request the phone numbers of all phones that connected to a specific tower within a given period of time. Beyond this list, law enforcement could also request customer information, allowing them to match the cell numbers with a specific customer's name, address, and other account information.

Under the Stored Communications Act (SCA), information can be obtained from phone companies (and other service providers) by use of a subpoena, 2703(d) order, or search warrant, depending on the type of data requested. For example, a subpoena can be used to obtain basic subscriber information. However, account logs and transactional records require a 2703(d) order - which requires specific and articulable facts to believe the records are relevant to an ongoing criminal investigation.

So the question to my readers is this - what type of process is required for a tower dump? We're just curious as to how easily phone companies are giving the information away. The specific and articulable facts standard seems too high for a tower dump, but a subpoena doesn't exactly seem sufficient. Or does a tower dump even fit under the SCA since that report alone only gives away phone numbers and not account information? Please leave a comment to this article if you have any ideas.

After a quick search, I was only able to find one reported case that mentions tower dumps - Jackson v. State, 716 S.E.2d 188 (Ga. 2011). In that case, police had obtained the defendant's cell number from a tower dump following a series of crimes. This, of course, only showed the defendant was in the area of the crime. On appeal, Jackson argued that the records are "not sufficient corroborating evidence as they only establish where his cell phone was at the time of the crimes, and not where he was, since he may have let a friend borrow his phone." The Georgia Supreme Court upheld the use of the records. Unfortunately, proper process was not an issue in that case.

Last month, the ACLU released a report on the use of cell site data by law enforcement. Click here for my earlier post.

Read More

Massachusetts court finds warrant necessary for CSLI

A Massachusetts appellate court has joined the list of courts requiring a search warrant for cell site location information. Commonwealth v. Pitt, 2012 Mass. Super. LEXIS 39. (Please forgive the block quotes, but the court's language, though familiar, is worth reading.)

[T]he Fourth Amendment's warrant requirement cannot protect citizens' privacy if a court determines whether a warrant is required only after the search has occurred, and the incursion into a citizen's private affairs has already taken place. The Fourth Amendment would offer but hollow protection indeed if government agents were free to embark on random forays into a citizen's historical location at will, constrained only by the possibility that the fruits of their endeavor would be suppressed if they happened to verge into a citizen's home or other "private" location. ... 

A ping off a cell phone tower in the vicinity of the meeting house of the local chapter of the NAACP, the Right to Life Foundation, the Gay and Lesbian Advocates and Defenders, or Fathers4Justice, at the times those organizations hold meetings, could suggest participation. Repeated pings, obtained from several uses of CSLI, would strongly indicate membership. There is no principled basis in current Fourth Amendment law to conclude that no warrant is required for a single use of CSLI, but that a warrant would be required as repeated use of that technology becomes more invasive. Accepting the Commonwealth's argument that no warrant is required to access CSLI because there is no expectation of privacy in that information would permit repeated examinations of a range of location data without a warrant just as readily as it would permit the single discrete examination of that data here. ... 

Consistent with this statement of social policy, and with the authorities discussed above, this court concludes that a warrant was required before the FBI, acting on behalf of the Commonwealth accessed the defendant's CSLI, and that the failure to secure one contravenes the Fourth Amendment in a manner that requires suppression.

The court began the discussion on CSLI by quoting some text from Smith v. Maryland that I had not noticed before - "All subscribers realize, moreover, that the phone company has facilities for making permanent records of the numbers they dial, for they see a list of their long-distance (toll) calls on their monthly bills." Perhaps the argument is out of date today because of understandings with regard to basic understandings on this issue, but my cell phone bills have never included a list of phone calls I have made. Could that lead a reasonable person to think that phone companies do not keep a record of that information?

Read More