In huge privacy win, US Supreme Court rules warrant needed to slurp folks' location data
A digital era defining decision
In a decision that will define privacy in the digital age, the US Supreme Court decided 5-4 on Friday that the government needs a warrant to access its citizens' mobile phone location data.
Written by Chief Justice John Roberts and joined by the four liberal justices, the majority opinion extended the Fourth Amendment on unreasonable search to include location records that mobile phone operators hold on their customers – a critical distinction that extends privacy protections beyond a physical device.
Building on another landmark case in 2014 when the courts decided that a warrant was required to search a mobile phone, the court decided that the "reasonable expectation of privacy" that people have in their "physical movements" should extend to records stored by third parties.
The case itself concerns Timothy Carpenter who was arrested in 2011 as part of an investigation into armed robberies at Radio Shack and T‑Mobile USA stores in and around Detroit. The police went to mobile phone operators and retrieved four months' worth of location data (known as CSLI or cell site location information) that showed Carpenter was near each of the locations when they were robbed.
The evidence proved crucial to his conviction and 116-year sentence but Carpenter's lawyers argued that the gathering of his location data violated the Fourth Amendment. They lost on appeal with the Sixth Circuit.
That Sixth Circuit decision has however been both supported and opposed by a number of other appeals courts (the Fifth, Ninth and Eleventh Courts have all decided on similar cases), making it not only a prime candidate for Supreme Court review but also a closely watched case.
Thanks to its potentially huge implications, the court was careful to stress that its decision was narrow and only covers the specific issue of location data held on an individual by a mobile operator.
Narrow, very narrow
It specifically noted that the decision should not extend to "conventional surveillance techniques and tools, such as security cameras; does not address other business records that might incidentally reveal location information; and does not consider other collection techniques involving foreign affairs or national security." So warrantless spying is still fine.
It also says that there will be "case-specific exceptions" that "may support a warrantless search" and gives the examples of "bomb threats, active shootings, and child abductions."
Regardless, the decision to extend the Fourth Amendment outside of someone's immediate possessions, their home or current residence, is a fundamental shift in the law and will be especially important given how things have changed with ubiquitous smart phones, internet access and cloud storage.
Supreme Court punts on Microsoft email seizure decision after Cloud Act passes US CongressREAD MORE
The court noted that this case - where personal location is stored by a third party - "does not fit neatly under existing precedents but lies at the intersection of two lines of cases." But it makes a solid case for arguing why it should receive greater protections under the Fourth Amendment rather than be held to be legally equivalent to bank records and dialed telephone numbers.
It notes, for example, that the CSLI data is "detailed, encyclopedic, and effortlessly compiled." It also notes that the data is constantly gathered and stored by a mobile operator, making it different to the situation when someone actively calls a number or makes a financial transaction.
Location data required greater protections because it offers "near perfect surveillance" by allowing the government to "travel back in time to retrace a person’s whereabouts, subject only to the five-year retention policies of most wireless carriers."
The majority decision argues that mobile phones and their related services are "indispensable to participation in modern society" – shooting down an argument that people can choose to opt out of carrying a phone if they wish to avoid being tracked.
The overall upshot of the decision is that the cops will need to provide a higher degree of proof to a judge – that of "probable cause" – before they can access someone's location data. Currently many authorities only need to prove "reasonable suspicion" that someone may have carried out a crime to be granted rights to that data.
The entire decision can be viewed as an effort to reach a new balance over citizens' privacy in the internet era without disrupting current approaches too much.
To that end, the dissenting arguments serve to highlight that the correct equilibrium may have been reached.
One core dissenting argument is that the Fourth Amendment should only extend to "persons, houses, papers, and effects" as per the exact wording of the Constitution. This "originalist" approach – which was championed by former justice Antonin Scalia – is popular with some of the court but seems faintly ridiculous when contrasted with the modern world. If the Founding Fathers had mobile phones, it's not hard to imagine that Thomas Jefferson would have announced a differently worded version of the Fourth Amendment.
As it is, the court's decision shoots down that line of thinking by arguing that "CSLI is an entirely different species of business record - something that implicates basic Fourth Amendment concerns about arbitrary government power much more directly than corporate tax or payroll ledgers."
Furthermore, the court notes that if it were to adopt an originalist approach then "no type of record would ever be protected by the warrant requirement" because everything these days is stored electronically.
Another core argument put forward by Justice Kennedy and joined by Thomas and Alito, was that because mobile operators sell that location data to data aggregators, users can "'assert neither ownership nor possession' of the records and has no control over them."
Not so much
This argument has been undermined literally this week however when all four major mobile operators agreed to stop selling that data after Senator Ron Wyden wrote a letter to each of them asking them about the practice. If companies are willing to drop a service in response to a single letter from a single senator, it is clearly a weak foundation on which to build a Supreme Court precedent.
There is a significant amount of other back-and-forth between the justices - leading to a lengthy 119-page judgment – but fundamentally the decision is there and it is a strong one in favor of individual privacy against the powers of the state.
Alongside NSA spying, another big issue that the court purposefully refused to include was the controversial use of so-called Stingray devices that pretend to be cell towers and suck up people's information as a way of tracking people.
Just as with an earlier decision this week by the Supreme Court – which required online retailers to pay state sales taxes – it is a good one that reflects the fact that the internet is no longer a special exception to our lives but a critical and indivisible component of modern life. ®
Sponsored: Becoming a Pragmatic Security Leader