Massachusetts Court Blocks Warrantless Access to Real-Time Location Data
eff.org
eff.org
That seems like precisely the information that should require a warrant, no?
Since this info is shared with a third party (the phone company) it’s no longer considered private.
Of course that’s problematic but that’s the basic concept.
United States v. Graham held, with significant controversy, that obtaining historical location data from a phone company is shared with a third party and so lacks 4th Amendment protection.
But the Massachusetts court finding for this case centered on the ping; law enforcement can't ask third parties to conduct specific searches in its place, which was effectively what they did here. (Similarly, there's a standing case about the FBI use of paid GeekSquad informants which hinges on whether they were being paid for discoveries in the course of work, or implicitly hired to conduct searches.)
That said, two judges here held that even if the Fourth Amendment doesn't protect location data, the Massachusetts constitution does. So once the targeted-request program ends, we may see this question revisited.
There's precedent allowing use of such data without a warrant where there is an immediate need, but probably no clear boundary in precedent: taking a broad interpretation of authority which clearly exists in some form until courts have drawn a clear demarcation is not at all unusual.
> That seems like precisely the information that should require a warrant, no?
No, I think the set of legitimate warrantless access to such data (the exigent circumstances the court refers to) would be a subset of the set of less-than-six-hour-old data, so the limitation the State appl d is in the right direction though still very much too broad; if it only allowed historical but not current data, then it would be precisely the information that should require a warrant rather than a far-too-broad line around legitimate warrantless access.
It is a flaw in our current system. It is most obvious at the federal level, where the President and many Republicans routinely break laws in obvious manners, while the courts fight it out for years.
[1] Some of our laws are based on what is 'normal'. So after some years of a practice taking place clearly illegally, it can become to be seen as 'normal' by society and therefore legalized de facto. For example "cruel and unusual punishment" does not outlaw the death penalty because it already exists and is sufficiently common to not count as unusual.
Can you link to some citations regarding this? If one of our political parties and our elected officials are brazenly breaking the law I'd sure like to know about it!
From a story about warrantless access to location data to... this comment.
First, warrantless access to XYZ is an issue with the criminal justice system, and I know you'll find people of all different political persuasions acting to keep that system in place and make prosecution as efficient as possible. It benefits them materially.
Second, the "Federal" government is overwhelmingly staffed by Democrats. In case you did not know, the Federal government is not just members of Congress. It includes the many departments of the Executive branch, and Trump can't just fire everyone and only hire Republicans. Scroll down here and look at what parties government workers donate to: https://www.fedsmith.com/2016/12/21/tallying-political-donat...
What level of involvement do you think those people have? Do you think the President or all of the Republican Senators are doing their jobs for them? What would it take to convince you that a Federal government is gonna do Federal government shit regardless of whether a D or R is in office?
https://en.wikipedia.org/wiki/Third-party_doctrine
Everyone storing data in "the cloud" is also at risk, the cloud provider can voluntarily hand data to law enforcement at their discretion. IIRC this also comes into play when your email messages are hosted on a 3rd party server that you do not own.
Under the ECPA they need to obtain a warrant for email and other cloud storage services, unless it's older than 180 days... then it's considered "abandoned".
There's been some effort to remove the 180 day limit.. some states have laws that protect older data + the 6th circuit already extended it past 180 days in US v Warshark.. but we need a national law like the Email Privacy Act that the House passed last year (but the senate didn't):
https://www.natlawreview.com/article/house-judiciary-committ...
This alows them to bot have those emails available to government spying as a writ.
One company who does this is lockheed.
Basically if you are a defense contractor - you do this.
Large companies, especially public ones and those doing business with the government, follow different sets of rules specifying retention times. For anything that has an impact on accounting, the minimum is usually 5 years. If you’re trying to get an FAA approval for anything that flies, it’s much longer.
Bonus: the 180 days mentioned above is for third party service providers as the cutoff of considering information to be “in transit”. Is has absolutely no bearing on in-house systems which have first-party protection.
Lockheed is shady as fuck. I have stories. But will not share them here..
ECPA is about unauthorised access (think tapping a phone line, but for the digital age) to electronic communications/cloud data. The Third-Party Doctrine is explicitly about the Government requesting these records - thus they would do not fall under "unauthorised access" in the sense used under the ECPA. Basically they cover two completely different situations.
The ECPA isn't just about unauthorized access. It also has provisions, such as the Stored Communications Act (a subset of the ECPA), that apply to the 3P situation you described where "Government request[s] these records." For example, 18 U.S.C. 2703(a) (titled "Required disclosure of customer communications or records") reads "[a] governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in ..."
In response to the original comment, the State's position that "it could warrantlessly get cell phone location data to find anyone, anytime, at any place as long as it was less than six hours old" was in part based on a previous Supreme Court case, Carpenter v. United States. Carpenter concerned federal prosecutors' attempts to get CSLI information using a court order pursuant to the Stored Communications Act -- 18 U.S.C. 2703(d).
As far as the Massachusetts Constitution, two of the judges here held that this type of location data is protected. The majority focused on the government action (it's not third party if the police actively cause a third party to do something), but the broader question might get revisited in a later case.
The article mentions that the EFF:
> ...asked the court to recognize, as the Supreme Court did in U.S. v Carpenter, that people have a constitutional right to privacy in their physical movements.
But SCOTUSblog's reporting of that decision makes it clear that [1]:
> Roberts also left open the possibility that law-enforcement officials might not need a warrant to obtain cell-site location records for a shorter period of time than the seven days at issue in Carpenter’s case – which might allow them to get information about where someone was on the day of a crime, for example.
There are two dimensions involved: who's being tracked, and how long it's been tracked. In Carpenter's case, someone was tracked for 7 days without a warrant, while in Almonor, it was only 6 hours. Additionally, the EFF post suggests that this was a much more targeted search (one for specific suspects only) than the one in Carpenter.
As much as I dislike the idea of warrantless phone tracking, since Roberts crossed over to vote with the liberals on the side of a narrow majority on Carpenter, there's a decent chance this might get overturned on appeal.
[1] https://www.scotusblog.com/2018/06/opinion-analysis-court-ho...
> "Although the defendant raised both federal and state constitutional claims in Almonor, the court based its decision solely on Article 14 of the Massachusetts Declaration of Rights, which was drafted before—and served as one of the models for—our federal Bill of Rights. Article 14, one of the cornerstones of the Massachusetts Constitution, is the state’s equivalent to the Fourth Amendment. As the court notes, it 'does, or may, afford more substantive protection to individuals than that which prevails under the Constitution of the United States.'"
(From original article.)
> "the U.S. Supreme Court may hear appeals from state supreme courts only if there is a question of law under the United States Constitution (which includes issues arising from federal treaties, statutes, or regulations), and those appeals are heard at the Court's sole discretion (that is, only if the Court grants a petition for writ of certiorari)."
(https://en.wikipedia.org/wiki/State_supreme_court#Influence_...)
[0] https://www.nytimes.com/interactive/2019/04/13/us/google-loc...
Rand Paul 2020.
Hopefully it move up to SCOUS.
Search warrants are narrowly scoped. If they find evidence of other law breaking while executing the warrant, it's inadmissible in court. (unless they witness these crimes taking place)
They're only allowed to go after the crimes that they are already aware of.
So for instance if the police have probable cause that a wanted criminal is at your house they can get a search warrant to search it for him. If while searching they see illegal drugs on your coffee table they can use that evidence under the plain view exception. However if they open up your schoolbag and find drugs they would not be able to use that as evidence because there is no way a person can fit inside your bag so searching it couldn't have been part of the search authorized by the warrant.
The solution would be to not disseminate it, but we, as a collective, have agreed to not make privacy a concern so far.
The biggest irony of all is, as we saw with gdpr, most hn users are nominally for privacy until regulation is implemented and we realize that we(most programmers) are the people making a living off of the current state of privacy.
And depending on the issue at stake, a more liberal or more conservative view might give you greater rights.
Given the current state of affairs, doesn't that effectively amount to not carrying a cell phone if you don't want to be tracked? It's not reasonable to assume that I opted in to sharing my data given that no realistic alternative is available to me.
I do see your point though - if third party exchanges dealing in such data are legal, then why can't the government use it? It does seem inconsistent.
Personally, I think GDPR was a reasonable first step down the path of regulation. I would personally like to see a regulation in the US that forced companies to offer data reselling as an add-on to a base package. As a programmer in 2019, I think it's a bit hypocritical of me to opt-in to the industry that is responsible for the situation we are in while saying 'regulation is the solution here'.
But it's important to note that we've moved from a legal to a moral question. Legally, I believe the government is currently in the right. Morally, the situation sucks and we should change it.
Ehh, it's not as though changing your profession would have any sort of meaningful influence on something as large and nebulous as data harvesting, aggregation, sale, and similar. Where would you even draw the line? I suspect you would have trouble finding a reasonably sized company to work for that doesn't engage with adtech or use some form of analytics in some way. Regulation is the only solution I can see here.
Unless you are responsible for the current situation then you aren't being hypocritical. I'm a programmer and only develop free software. I don't at all feel hypocritical to day that tech companies should be far more strictly regulated when it comes to user privacy and (god forbid!) ethics.
SCOTUS ruled explicitly on this question in Katz vs. US -- wiretapping is unconstitutional, regardless of physical intrusion. Just because you route your voice through a switch owned and controlled by a third part does not mean you give up your expectation of privacy.
That's not what is happening here. The police are not purchasing access like an advertiser would; they are receiving special access for the purpose of tracking suspects.
> If you had, I imagine SCOTUS would rule differently.
The SCOTUS of the 1960s was very clear -- routing your communication through a corporate party does not, in any way, negate your expectation of privacy from your own government!
SCOTUS has changed drastically since the 1960s, and I will be unsurprised if SCOTUS rolls back every single 'privacy' case that it encounters. But that has nothing to do with the merits of these cases; it's a way of salting the earth so that Roe v. Wade can be overturned while appearing less overtly political.
Yes, but my point was that we're only arguing about how much someone should have to spend to gain access.
> The SCOTUS of the 1960s was very clear -- routing your communication through a corporate party does not,
But my point, _again_, is that they were _not_ clear that you have some expectation of privacy after _selling your personal data on an exchange_.
We do? How does that work? I have a cell phone and I have not given my cell phone provider any permission to do this with the location data it has.
1 - https://www.t-mobile.com/responsibility/privacy/privacy-poli...
And the enforceability of EULAs is a fairly complicated topic, it's not as cut-and-dry as "you signed it".
"To identify and suggest products or services that might interest you" -- means your data can be shared or sold to be used in advertising models.
"To provide you customized user experiences, including personalized product and service offerings;" -- same
"We may ... provide access to, or disclose ... location data without your approval to ... operate and improve ... our business," ellipses added so you can see it literally says we can give your data away for money.
I probably should have used the word "totalitarian". Yes, MA is a representative (some groups being much better represented than others) democracy. It still carries out the will of "the people" with an iron fist though. The people and government of MA basically worship government authority as though it is some inherent force of good in the world. When the government is doing something wrong the socially acceptable thing to do in MA is to bend over and take it. In other, less authoritarian, places it's socially acceptable to disobey the government or at least walk the line by complying with the letter instead of the intent. And by socially acceptable I mean that even the people working for the state will exercise discretion.
It's kind of hard to convey in an internet comment but the people of MA kind of treat the government like people used to treat the church 200yr ago. I got chastised by a couple of my coworkers for replacing my own damn water heater (one of the state's more asinine laws is that all plumbing requires a licensed plumber), not because "OMG, it could leak" but because I disobeyed the law. I find that kind of religious devotion to the authority of the state even when it is nonsensical to be very disagreeable.
>It has one of the lowest rates of police violence in the country
The cops are too busy meddling in matters of economic interest to them. Also it's a fairly left state and the police aren't idiots so they know they can't get away with rampant violence. It definitively could be worse. That doesn't mean the current situation is in any way satisfactory.
>I don't understand the quip about the cops either
The state police has tons of influence at all levels of government so the government given a choice between something that's good for the people vs good for the police will side with the police. The only time they typically don't is when the trade-off is between the government in general vs the police. MA judged are very much known for reading political pros and cons between the letters of the law. This is is a longstanding gripe many people have. That a MA judge read the law and interpreted it to deny power to the police is an unexpected outcome.