Ah, those cell towers. The little old Radio Shack robbery case that could really impact digital privacy

 Oh, the data those cellphone towers can collect

28 November 2017 (Paris, France) – Hitting all the digital privacy blogs over the last few weeks is a case on tomorrow’s docket at the U.S. Supreme Court. It’s Carpenter v. United States, No. 16-402, and it is a potential blockbuster. The Court will consider whether prosecutors violated the Fourth Amendment, which bars unreasonable searches, by collecting vast amounts of data from cellphone companies showing the movements of the man they say organized a slew of robberies. Most pundits opine that the case that could transform privacy law in the digital era.

It all began with the armed robbery of a Radio Shack store in Detroit, a couple of weeks before Christmas in 2010. In the next three months, eight more stores in Michigan and Ohio were robbed at gunpoint. The robbers took bags filled with smartphones. Their own phones would help send them to prison. Even BBC 4 Radio had a piece on it, quoting Jeffrey Rosen (president of the National Constitution Center, a nonprofit group devoted to educating the public about the Constitution) who said “Carpenter could be the most important electronic privacy case of the 21st century.”

Over the weekend I read most of the briefs in the case and at its most basic the Court will consider the scope of the Fourth Amendment’s protection of information contained in a cellular carrier’s records that reflects the location of cell towers used to complete customers’ phone calls and convey their texts. At stake will be at least two traditional notions underlying the court’s Fourth Amendment jurisprudence:

1. The first is the general understanding that information voluntarily exposed to others is not protected by the Fourth Amendment, and
2. the second is the more specific “third-party doctrine,” which holds that government access to information collected by a private business in order to provide a service to a customer does not constitute a search.

What is interesting is that in a pair of recent decisions (see below), the Court expressed discomfort with allowing unlimited government access to digital data. It limited the ability of the police to use GPS devices to track suspects’ movements, and it required a warrant to search cellphones.

The most interesting brief in the Carpenter case was the one filed by technology companies (including Apple, Facebook and Google) which urges the Supreme Court to continue to bring Fourth Amendment law into the modern era:

“No constitutional doctrine should presume that consumers assume the risk of warrantless government surveillance simply by using technologies that are beneficial and increasingly integrated into modern life.”

So, the court’s decision (expected by June) will apply the Fourth Amendment, drafted in the 18th century, to a world in which people’s movements are continuously recorded by devices in their cars, pockets and purses, by toll plazas and by transit systems. The court’s reasoning may also apply to email and text messages, internet searches, and bank and credit card records. And as noted by constitutional authority (well, in my mind) Orin Kerr what we have is a case “hugely important in that it defines the constitutional role in a really wide range of cases”. More of his thoughts here.

A brief recitation of the case

I will skip a recitation of this case’s long march through the various courts and just get to the nubs:

• The case concerns Timothy Ivory Carpenter, who witnesses said had planned the robberies, supplied guns and served as lookout, typically waiting in a stolen car across the street. “At his signal, the robbers entered the store, brandished their guns, herded customers and employees to the back, and ordered the employees to fill the robbers’ bags with new smartphones,” a court decision said, summarizing the evidence against him.
• In addition to presenting testimony, prosecutors relied on months of records obtained from cellphone companies to prove their case. The records showed that Carpenter’s phone had been nearby when several of the robberies happened. He was convicted and sentenced to 116 years in prison.
• Carpenter’s lawyers said cellphone companies had turned over 127 days of records that placed his phone at 12,898 locations, based on information from cellphone towers. Prosecutors could tell whether he had slept at home on given nights and whether he attended his usual church on Sunday mornings.
• Best bit from Nathan Freed, a lawyer with the American Civil Liberties Union, which represents Carpenter: “Never before in the history of policing has the government had the time machine it has here”. His position is that prosecutors should be required to obtain a warrant when they seek more than 24 hours’ worth of location data.

So where be the law now?

The Cornell Law School web site, the scotusblog and Orin Kerr’s blog had some nice summaries so herein a bit of a mashup:

• Older Supreme Court decisions indicate that no warrant was required. In 1979, for instance, in Smith v. Maryland, the Supreme Court ruled that a robbery suspect had no reasonable expectation that his right to privacy extended to the numbers dialed from his landline phone. The court reasoned that the suspect had voluntarily turned over that information to a third party: the phone company.
• Relying on the Smith decision’s “third-party doctrine,” federal appeals courts have said government investigators seeking data from cellphone companies showing users’ movements also do not require a warrant.
• A federal law, the Stored Communications Act, does require prosecutors to go to court to obtain tracking data, but the showing they must make under the law is not probable cause, the standard for a warrant. Instead, they must demonstrate only that there were “specific and articulable facts showing that there are reasonable grounds to believe” that the records sought “are relevant and material to an ongoing criminal investigation.”
• Orin Kerr has a long piece on this and his position is Congress was better suited than the courts to strike the right balance between the government’s need for information and privacy rights. In Carpenter’s case, he says the Fourth Amendment should not apply because there was no search.
• Carpenter’s lawyers in their briefs rely on two recent and unanimous Supreme Court decisions expressing discomfort with the collection of large amounts of digital data. In 2014, in Riley v. California, the court said the police must generally have a warrant to search the cellphones of people they arrest. The quote Chief Justice John G. Roberts Jr. wrote for the court:

“Modern cellphones are not just another technological convenience. Even the word cellphone is a misnomer. They could just as easily be called cameras, video players, Rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps or newspapers”.

• But as the scotusblog points out, the Riley case concerned information possessed by the person arrested. Carpenter’s case concerns information held by cellphone companies.
• The second case, United States v. Jones, in 2012, concerned a GPS device that the police attached to a suspect’s car, allowing them to track his movements for 28 days. All nine justices agreed that this was problematic under the Fourth Amendment, but they were divided on the rationale for the decision. The majority said the police were not entitled to place the device on private property. But five justices in concurring opinions expressed unease with the government’s ability to vacuum up troves of private information:

“The use of longer-term GPS monitoring in investigations of most offenses impinges on expectations of privacy. Society’s expectation has been that law enforcement agents and others would not — and indeed, in the main, simply could not — secretly monitor and catalog every single movement of an individual’s car for a very long period.”

• One point not covered but which I know from my mobile technology work: cellphone tower information is not nearly as accurate as that generated by GPS devices, but it is catching up.

So where might we be going with this case?

Many of the pundits on this case who have done a deeper dive than I have (and who generally favor broad privacy protections) think the Carpenter case will transform Fourth Amendment law however the court rules. If the court squarely recognizes what it’s been suggesting in recent cases, namely that we do have an expectation of privacy in our digital data and public movements and that the Fourth Amendment prohibits the government from tracking us door to door for weeks in public, that would be an occasion for dancing in the streets. If the court holds that we don’t have an expectation of privacy in public except when there is some sort of physical trespass involved, that could be a huge setback for privacy.

But I do not think the issue is as clear cut for some members of the Supreme Court. One of the briefs I read noted that in  United States v. Jones (which I referenced above) Justice Sonia Sotomayor wrote that, although the third-party doctrine was not at issue in that case, it might in the future

“be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”

And Justice Samuel Alito, writing for himself and three other members of the court, noted in Jones that long-term monitoring of specific GPS-location data could

“impinge on expectations of privacy, and legislative solutions might be best suited to balance these concerns with public safety in an era of dramatic technological change.”

Having followed and read enough of these decisions, we know that the way in which the Supreme Court resolves these issues in Carpenter will undoubtedly revolve around how the justices view the scope of the issue presented. If the question is, as some suggest, whether the Fourth Amendment does anything to regulate government access to the “nearly limitless” information stored by telecommunications companies and internet service providers, many of the justices are likely to be reluctant to sign on to an expansive application of traditional doctrines. But if the issue is confined to the particular type of information involved in this case, the specific privacy interests at stake, the judicial mechanism Congress provided to restrict access to the information and the legitimacy of the government’s interest in the information, the outcome may well be different.

I have focused on this case because I think the privacy concerns raised by the specific information at stake in this case may be far less significant than those attached to other types of information a digital consumer provides to carriers or internet providers. The information obtained in Carpenter’s case involved only the location of towers used to convey calls and messages, and not, notably, the content of any communication. As the 6th Circuit noted, in the telecommunications context, the Supreme Court has traditionally distinguished between content-related information and information about the mechanisms used to convey the message. And, whatever the precise contours of the line between “content” and “non-content,” in this case there seems little doubt that the information was not content-related.

Moreover, as Chris Costello noted on a blog post (Chris is a lawyer and mobile tech expert):

unlike the specific GPS coordinates in Jones, accurate to within 100 feet, the information in Carpenter was non-specific, placing the phone as far away as two miles from the towers, and only within a one-third or one-sixth sector of the tower. Nor is the tower identified in records like those at issue in this case necessarily the closest one to the caller, because two people making calls from the same car at the same time may be employing two different towers, depending on, among other things, whether one tower has reached its capacity.

This difference in specificity between GPS data and cell-site information would appear to be significant. Rather than allowing the government to observe what businesses or residences a phone subscriber visits, and thus, as Sotomayor feared, compile a “comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations,” the records in this case identified at best a general neighborhood or group of neighborhoods, which, in an urban context, potentially covers hundreds or thousands of businesses and residences.

Nor is the privacy interest in location information, something traditionally exposed to the public and observable by the government, greater than the privacy interest in other types of documents clearly covered by the third-party doctrine. Numbers dialed from a phone, for example, which are far more specific and in many ways more revealing than the location of cell towers, fall squarely within the third-party doctrine and may be accessed without resort to any court order, as the Supreme Court held in Smith v. Maryland. According to United States v. Miller, the same is true of bank records and other financial information, which many consider to be highly personal and private.

And although some litigants and commentators have challenged the voluntariness of a cellphone customer’s disclosure of location information, cellphone users, as the 6th Circuit noted, generally understand that the phone company completes calls by the use of cell towers and knows what towers are being used to complete a customer’s calls. Moreover, all carriers provide notice of their privacy policies, which routinely include warnings that information is collected in connection with the provision of a carrier’s services and that this information may be provided to law enforcement.

Let me round this out with a very condensed mash up of some points made by Amy Howe and Alan Butler of the scotusblog, both constitutional pros and both of whom have done a pretty heavy review of this case:

• The legitimate interest of law enforcement in historical cell-site location information in certain cases is very compelling, because it provides an important investigative tool when it may be difficult or impossible to show probable cause. Orders may be used, for example, to obtain the location history of homicide victims to determine their whereabouts immediately prior to their deaths, thereby aiding in the investigation of relevant events and possible causes.
• Similarly, when multiple legitimate suspects could have motives for committing a crime, location information may exclude some or all of these suspects.
• Historical cell-site information can also be used to check the reliability of information provided by informants or contained in the statements of accomplices. And, when pattern crimes are alleged, review of cell-site location data can provide critical evidence of, for example, an individual’s commission of serial killings or a person’s participation in pattern robberies or burglaries like the one in this case, because presence at multiple crime scenes or other relevant locations over a period of many days or weeks is not likely to be mere coincidence. In this way, a Section 2703 order provides an essential investigative tool, often used in conjunction with subpoena requests and other investigative techniques, that imposes minimal intrusions on any legitimate expectations of privacy.

So the Court’s decision in Carpenter will thus likely turn on how broadly the justices view the question presented in the case. Whatever the outcome, the Supreme Court’s decision is likely to be merely the opening salvo in the legal debate rather than a definitive resolution of the issues raised by law-enforcement access to cell-site location information.