Categories
Privacy

Cell site records privacy comes to the Supreme Court

This fall the Supreme Court will decide whether to hear an appeal that addresses the privacy each of us has in information our cellphones exchange with the network that reveals our movements over time.

The matter comes to the Court in an appeal by Quartavious Davis, an Alabama man who was convicted in 2011 of a string of seven armed robberies in Miami, Florida that netted him a sentence of 162 years in prison. Federal prosecutors tied Davis to the heists—which included robbing a pharmacy, an auto parts store, a beauty salon, and a fast food restaurant—in part from transmissions between his cellphone and the towers it transmitted to as he moved about town.

Prosecutors obtained the cell site data pursuant to an order from a federal magistrate judge that authorized them to review Davis’ phone location for a period of 67 days in September and October of 2010 that straddled the heists.

According to court papers, the records, which prosecutors obtained from MetroPCS, Davis’ service provider, revealed 11,606 points of information about his whereabouts, including calls he allegedly placed to and received from co-conspirators.

At trial, Davis moved to exclude the location information, asserting that prosecutors obtained it without a search warrant. Prosecutors relied instead on the Stored Communications Act, a federal law that authorizes law enforcement to obtain records a magistrate deems relevant to an ongoing criminal investigation.

The problem, Davis asserts, is that the government’s obtaining the location data constituted a search within the meaning of the Fourth Amendment. That required prosecutors to obtain a warrant supported by probable cause, which means prosecutors would have had to demonstrate to a judge a reasonable basis for believing a crime had been committed.

The distinction matters to Davis, who was sentenced at age 22 and faces the rest of his live in prison, but also to anyone who uses a cellphone, which is to say nearly all of us. Ninety-two percent of American adults own a cellphone or smartphone, according to a study published in August by the Pew Research Center. And 90 percent of cellphone owners say they frequently carry their phone with them.

Cell site information reveals an abundance of information about us. As Justice Sotomayor wrote in 2012 in a case that found the government’s attaching a GPS device to a vehicle for 28 days to be a search within the meaning of the Fourth Amendment, “I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on.”

Davis’ appeal presents the Court with an opportunity to revisit the so-called third-party doctrine, which holds that you lack a reasonable expectation of privacy in information you disclose voluntarily to third parties. The approach, which traditionally applied to things like a suspect’s bank records, makes less sense in an age in which, as Justice Sotomayor noted in the concurrence cited above, “people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”

The Court has recognized as much. Last year the justices ruled unanimously that police may not, without a warrant, search information on a cellphone from someone who has been arrested. Writing for the Court, Justice Roberts noted:

“Prior to the digital age, people did not typically carry a cache of sensitive personal information with them as they went about their day. Now it is the person who is not carrying a cellphone, with all that it contains, who is the exception. According to one poll, nearly three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting that they even use their phones in the shower.”

In Davis’ case, a three-judge panel of the U.S. Court of Appeals for the 11th Circuit ruled that the government violated his rights under the Fourth Amendment by obtaining the cell site location records without a warrant. Still, the panel sided with the trial judge and upheld the conviction because prosecutors relied in good faith on the magistrate’s order.

By a vote of 6 to 5, the entire Eleventh Circuit later reversed the panel, holding that the government did not violate the Fourth Amendment when it obtained the location data because Davis had no reasonable expectation of privacy in records held by his service provider.

The ruling set up a split among federal appeals courts. The U.S. Court of Appeals for the 4th Circuit ruled in August that the government’s accessing cell site data constitutes a search under the Fourth Amendment. That makes the case ripe for review by the Supreme Court, Davis contends. According to the Electronic Frontier Foundation, which filed a friend-of-the-court brief urging the Court to decide the case:

“Given the prevalence of cellphones and smartphones, and the increasing number of law enforcement requests for this sensitive information, this case thus presents a question of compelling national importance. The number of Americans promised that [cell site location information] remains private and accessible to law enforcement only with the protections of a search warrant is increasing. Yet, this legal protection is not uniform, and the federal courts in particular have issued conflicting opinions on the topic, leaving the public and law enforcement in limbo.”

The number of requests by law enforcement for location data is rising. According to figures cited by EFF, AT&T projects it will receive nearly 76,000 requests for cell site location information this year from law enforcement, up 19% from a year earlier and just under the number of such requests received in 2012. Verizon is projecting a 55% increase in the number of so-called cell tower dumps, a majority of which, EFF observes, occur without a warrant.

Note that Davis’ appeal ties to historical location data. Several states already require police to obtain a warrant before tracking a cellphone in real time. This chart from 2011 will give you a sense of how long your cellular provider retains a record of towers used by your phone.

For the Court to take up Davis’ case, at least four justices will have to vote to hear the appeal. In addition to an opportunity to unify the circuits, the justices could use the appeal to clarify the standard for assessing the government’s conduct. Orin Kerr, a professor of law at George Washington University, says the Eleventh Circuit’s reasoning also may make the case worthy of review. As Kerr wrote in The Washington Post following the appeals court decision:

“Instead of the… rule of a warrant, the court begins with general balancing. It’s important to catch criminals, the court reasons, and the statute has some good protections given that this wasn’t such an invasive practice. So on the whole the government’s conduct based on reasonable suspicion seems reasonable and therefore constitutional.

This alternative holding is a major development, I think. It’s at odds with the usual rule that a criminal search requires a warrant, and instead replaces it with a totality of the circumstances inquiry into whether the criminal search was the kind of thing that we would generally say is good or would generally say is bad. There’s not only no warrant requirement, there’s no probable cause requirement: It’s just a free-floating reasonableness inquiry.”

According to the Reporters Committee for Freedom of the Press, allowing warrantless access to cell site data also undermines freedoms guaranteed by the First Amendment. “In part because location data can be so revelatory, journalists frequently go to great lengths to ensure that the locations where they meet their sources are kept private, and that their communications are confidential,” the group writes in a friend-of-the-court brief.

From precedent, we know the justices are paying attention to the privacy implications of technology. In that regard, they seem likely to read a concurrence by Judge Robin Rosenbaum, a member of the Eleventh Circuit who, despite finding the search of Davis’ location data reasonable under the Stored Communications Act, expressed concern.

“In our time, unless a person is willing to live ‘off the grid,’ it is nearly impossible to avoid disclosing the most personal of information to third-party service providers on a constant basis, just to navigate daily life,” Rosenbaum wrote. “And the thought that the government should be able to access such information without the basic protection that a warrant offers is nothing less than chilling.”

Categories
Privacy

In shift, Justice Department requires warrants for using stingrays to spy on cellphones

The Justice Department has tightened restrictions for tracking cellphone signals in a move that officials say will improve transparency and protect the public from unwarranted invasions of privacy.

Henceforth the FBI and federal law-enforcement agencies will need a warrant supported by probable cause before using a so-called cell-site simulator, which can impersonate a cellphone tower by sending out signals that induce phones to respond with identifying information.

The move represents a win for privacy even though the warrant requirement doesn’t apply to state and local governments, which also use cell-site simulators to track suspects.

The devices, which are known variously as stingrays, dirtboxes or IMSI catchers (for International Mobile Subscriber Identity), are used widely for surveillance but have proved to be controversial because of their sweep and the secrecy that shrouds their use. Agents deploy the devices from cars and planes, which enable scanning across larger areas.

“Cell-site simulator technology has been instrumental in aiding law enforcement in a broad array of investigations, including kidnappings, fugitive investigations and complicated narcotics cases,” Deputy Attorney General Sally Quillan Yates said Thursday in a statement announcing the change. “This new policy ensures our protocols for this technology are consistent, well-managed and respectful of individuals’ privacy and civil liberties.”

The pivot by DOJ represents a departure from past practice, when law enforcement personnel had to certify merely that use of a cell-site simulator was relevant to an ongoing criminal investigation.

Under the revised guidelines, agents may not configure simulators to collect the contents of communications, including emails and text messages. Agents also must inform judges when applying for warrants that use of the device will capture information from cellphones in the vicinity that are not subject to the investigation, and that the simulator may disrupt service temporarily for all cellphones within reach of its signal. Officials also must detail to the court how they plan to delete data not associated with the device being targeted.

As is the case under the Fourth Amendment generally, federal officials can use a simulator without first obtaining a warrant in the event of so-called exigent circumstances or when the law does not require a warrant, in which instance agents must first obtain the OK of officials within DOJ.

The Guardian reported Friday that public defenders in Baltimore are examining more than 2,000 cases in which police used stingrays to gather evidence on suspects secretly. Prosecutors are obligated to disclose evidence against criminal defendants in the discovery phase of a criminal trial.

Categories
Life Privacy Tech

Facebook loses appeal over search warrants

Facebook cannot challenge the constitutionality of a search warrant on its users’ behalf prior to the government’s executing the warrant, an appeals court in New York has ruled in a decision that delineates a boundary for Internet privacy.

The ruling follows a lawsuit by Facebook to void 381 search warrants the company received two years ago from the Manhattan district attorney’s office, which obtained then in connection with an investigation into Social Security disability claims by a group of retired firefighters and police officers whom the DA suspected of feigning illness they attributed to the aftermath of the 9/11 attacks.

Upon receiving the warrants, which sought information derived from the users’ accounts, Facebook asked the DA to withdraw the warrants or to strike a provision that directed the company to refrain from disclosing their existence to users whose postings were to be searched. The DA’s office asserted the confidentiality requirement was needed to prevent the suspects being investigated from destroying evidence or fleeing the jurisdiction if they knew they were being investigated.

After the DA declined to withdraw the warrants, Facebook sued to either quash them or compel the DA remove the non-disclosure provision. The trial court sided with the DA and Facebook appealed.

The appeals court affirmed that the legality of the searches could be determined only after the searches themselves were conducted. “There is no constitutional or statutory right to challenge an alleged defective warrant before it is executed,” Judge Dianne Renwick wrote for a unanimous panel of the court’s appellate division in a ruling released July 21. “We see no basis for providing Facebook a greater right than its customers are afforded.”

The constitutional requirement that a warrant can issue only upon a showing of probable cause as determined by a judicial officer helps to ensure the government does not exceed its authority when requesting a search warrant and eliminates the need for a suspect to make a motion to void the warrant before it can be served, the court noted. “Indeed… the sole remedy for challenging the legality of a warrant is by a pretrial suppression motion which, if successful, will grant that relief,” Renwick explained.

According to Facebook, which was joined in the appeal by Google, Twitter, Microsoft and other tech industry firms, the federal Stored Communications Act also gave the company the right to challenge the warrants. But that law, which protects the privacy of email and other communications stored on servers belonging to ISPs, authorizes ISPs to challenge subpoenas and court orders but not warrants obtained from a judicial officer based on a showing of probable cause, the court noted.

Despite its ruling, the court agreed with Facebook that the DA’s serving 381 warrants swept broadly and suggested the users themselves may have grounds for suppression. “Facebook users share more intimate personal information through their Facebook accounts than may be revealed through rummaging about one’s home,” wrote Renwick. “These bulk warrants demanded ‘all’ communications in 24 broad categories from the 381 targeted accounts. Yet, of the 381 targeted Facebook users accounts only 62 were actually charged with any crime.”

Through civil liberties groups hoped the appeal might bolster protections for Internet privacy, experts said the ruling makes sense as a matter of law. As Orin Kerr, a professor of criminal procedure at George Washington University Law School who has written extensively about privacy and the Internet, wrote in The Washington Post:

“Think about how this plays out in an old-fashioned home search. If the cops show up at your door with a warrant to search your house, you have to let them search. You can’t stop them if you have legal concerns about the warrant. And if a target who is handed a warrant can’t bring a pre-enforcement challenge, then why should Facebook have greater rights to bring such a challenge on behalf of the targets, at least absent legislation giving them that right?”

Still, “that doesn’t mean the warrants were valid,” added Kerr, who imagined that the defendants themselves seem likely to challenge the sweep of the material seized from their Facebook accounts if they haven’t already.

For its part, Facebook disagreed with the ruling but said the company had not decided whether to appeal. “We continue to believe that overly broad search warrants—granting the government the ability to keep hundreds of people’s account information indefinitely—are unconstitutional and raise important concerns about the privacy of people’s online information,” Jay Nancarrow, a spokesman for the company, told the Times.

The DA’s office noted that the investigation led to the indictment of 134 people and alleged hundreds of millions of dollars in fraud. “In many cases, evidence on [the suspects’] Facebook accounts directly contradicted the lies the defendants told to the Social Security Administration,” Joan Vollero, a spokeswoman for the district attorney’s office, said in a statement.