09:52, June 23 324 0 theguardian.com

2018-06-23 09:52:04
'A crack in the edifice': privacy advocates hail supreme court cellphone data ruling

If you live in the US and carry a cellphone, you might as well be wearing an ankle monitor that logs your location every 15 minutes and maintains an archive of that information dating back as much as five years.

That may sound like the scaremongering of a privacy advocate, but the analogy comes from Chief Justice John Roberts who, on Friday, authored a majority opinion ruling in the supreme court that the government could no longer access an individual’s cellphone location data without a warrant.

“A cellphone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, political headquarters, and other potentially revealing locales,” Roberts wrote, noting that 12% of people even take their phones in the shower. “Accordingly, when the government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.”

The case, Carpenter v United States, is being hailed as a “groundbreaking victory for Americans’ privacy rights in the digital age” by Nathan Freed Wessler, the ACLU attorney who argued the case before the supreme court in November.

That is because, as Andrew Crocker of the Electronic Frontier Foundation explains, the ruling is “a crack in the edifice” of the “third-party doctrine” – a long-established legal theory that holds that if an individual shares information with a third party, they no longer enjoy constitutional privacy rights. In practical purposes, this means that the government needs only a subpoena or court order to obtain bank records or phone call history, rather than a search warrant – which is harder to get.

“The government has been close to running the table on those kind of cases,” Crocker said. “They’ve had almost free rein.”

The Carpenter case, for example, stems from an investigation into a string of robberies in Michigan in 2011. Armed with the cellphone numbers of 16 potential suspects, the FBI was able to get a court order for those numbers’ cell-site location information (CSLI). In the case of one of the suspects, Timothy Carpenter, the government received 12,898 time-stamped logs of every time the phone connected to a cellular network over 127 days, which averages out to a log of his location every 14 minutes for more than 4 months.

Under the third-party doctrine, Carpenter (or any other cellphone user) could not claim that this data was private because he had “shared” it with his mobile service provider.

And Carpenter’s case is by no means unusual. In an amicus brief he filed for the EFF, Crocker noted that AT&T received 70,528 requests for CSLI in 2016, while Verizon received 53,532. About 75% of the requests to Verizon in 2016 were made without a warrant.

And while the law has remained in the pre-smartphone age, the amount of data that we generate and share with third-parties – not just phone companies, but also internet service providers and web service providers – has rapidly expanded.

“It’s impossible to go five minutes without creating sensitive data that is then held by someone else,” said Crocker. “The amount of data being compiled about all of us just continues to grow and grow.”

Plus, the fact that those third-parties usually retain all that sensitive data for some length of time has meant that the government has access to “a surveillance time machine”, said Alex Abdo, senior staff attorney at the Knight First Amendment Institute.

Normally, when the government puts a suspect under surveillance (by, for example, tapping their phone or following them), the surveillance begins when the investigator gets authorization and then goes forward in time, Abdo explained. But with digital records like CSLI, the government can achieve retrospective surveillance of extraordinary detail.

In the Carpenter ruling, Roberts made clear that he is not comfortable writing off an individual’s right to privacy for this kind of incredibly detailed and practically unavoidable data just because it involves a third party.

“He tries to craft a narrow opinion, but you can see that he’s concerned with how to conceive of privacy in a world where we are all constantly tracked and monitored,” Abdo said. “Time will tell how far the courts will go in recognizing privacy in the digital age, but I think his opinion is a good omen.”

In a dissenting opinion, Justice Samuel Alito worried that the ruling “guarantees a blizzard of litigation while threatening many legitimate and valuable investigative practices upon which law enforcement has rightfully come to rely.”

Crocker concurred, saying, “You can be sure that EFF and the ACLU and our fellow travelers will be using these kinds of arguments for other forms of information that companies have access to.”