Posts Tagged ‘cell site’

No, that’s not what the Fifth Circuit said.

Wednesday, July 31st, 2013

The internet is abuzz over yesterday’s Fifth Circuit decision on cell-site data. And hardly anyone seems to know what they’re talking about, as usual.

It’s to be expected when sources like Wired say “cops can track cellphones without warrants, appeals court rules.” Which is not what the court ruled at all. After all, you can’t expect tech zines to be accurate on the law. And it’s to be expected when tons of people get all upset on sites like Reddit, because they only saw the inaccurate headlines and are now freaking out about something that never happened. But when the usually responsible New York Times jumps in with “warrantless cellphone tracking is upheld,” it might be time to get concerned.

Yes, there is a lot of concern these days with government access of our data. A lot of that concern is legitimate, and a lot is misplaced, but the fact that the conversation is even happening is a wonderful thing. Except the conversation is downright counterproductive when nobody knows what they’re talking about. And such lazy (or deceitful?) reporting isn’t doing anyone any good.

Here’s what the court said, in a nutshell:

1) The government wanted to get historical data of cell sites that were used by certain phones. Not real-time data. Not tracking.

2) Existing law says this is allowed when the government can provide specific and articulable facts that make it reasonable to conclude that the data will be relevant and material to an ongoing criminal investigation.

3) The government did exactly that.

4) The lower court screwed up, and applied the rule for getting real-time data. The lower court needs to do it over again. Period.

All the court did was apply existing law, correctly.

What the ACLU and EFF and others wanted, however, was for the court to break new ground, and create a new legal standard. I am in favor of such things — a court’s not going to do that unless you ask, and I encourage making such arguments at every meaningful opportunity. But this court said it wasn’t going to touch that issue with a ten foot pole. (It did suggest going to Congress, to change the law. Congress passed the statute that enables such requests of phone companies, and right now the statute simply tracks existing Fourth Amendment jurisprudence. But the statute could always impose greater burdens on the government than are required by the Fourth Amendment. The Constitution is a floor, not a ceiling, after all. So why not lobby Congress to amend the relevant statute?)

Or they could, you know, take it up with the Supreme Court and ask them to change their mind on what’s reasonable under the Fourth Amendment.

The problem, of course, is that the existing rule fits neatly within the general principles of how the Fourth Amendment works.

Basically, the Fourth Amendment comes into play when the government intrudes on something that you would reasonably expect to be private. They’re allowed to do it when they have a warrant based on probable cause to believe they’ll find evidence of a crime or catch a criminal. And they’re also allowed to do it without a warrant if it’s reasonable to let the government do so — when your privacy interests are outweighed by some other concern like public safety.

So the first issue is whether historical cell-site data is something you would reasonably expect to be private. The ACLU and EFF and others say it is. The government says it isn’t. And existing law says that it isn’t. This is the new ground that the court was being asked to break.

Cell site data is not something that you create. The government isn’t going into your phone or your computer to access the data. It’s not yours. Instead, it is a record kept by your phone company. They create the data, and they retain the data.

Cell site data does not contain the contents of your communications. What you’re saying and texting and emailing and posting are not being accessed. It only says what cell tower your phone was using at the time. Which can give a general idea of where your phone was at the time.

Historical cell site data does not tell the government where your phone is right now. It’s not a tracking device. It’s not real time. It just lists the towers your phone was using back then.

This cell site data is created by the business, not by you. And it’s about a transaction which that business engaged in. It’s not just about you. It’s a record of its interaction with your phone. It’s nothing more or less than a routine business record, of the business’s own activity, kept in the ordinary and regular course of business. It’s not about you.

And the government did not compel the business to collect that data.

So when the government goes to the business and says “give us those business records,” it is not so much your privacy that’s being invaded as it is the business’s privacy. The act of getting the data, the act itself, does not require any intrusion into your own privacy. They’re not going into your phone or home or computer to get it.

And the data itself is not something that’s yours to claim as your own private information. You didn’t create it, you didn’t keep it.

But the law does recognize that you do have some expectation of privacy here. Just not anywhere near as much as if you were the one who created or kept the data. So the government has to make some showing that it’s actually relevant to an actual criminal investigation. They just don’t have to show there’s probable cause to believe they’ll get evidence of a crime. It’s a similar standard as for getting a pen register — real-time data of the numbers you’re calling, without overhearing the contents of the communications.

Also, stepping away from your interests for a moment: We don’t want law enforcement* just randomly poking through records for no reason, hoping to chance on evidence of a crime — the Fourth Amendment hates it when that happens. It’s not about your privacy, but everyone’s. So they can’t demand records in bulk. They have to be records of a specific phone, that they have specific reason to believe will be useful. It’s arguable that this consideration is even more important than your privacy interests, when it comes to setting the standard the government has to meet.

In the end, the law just isn’t on the ACLU & EFF’s side right now. They need to change the law, if they want the government to have to jump through the probable cause hoop here. They made a game effort of asking the Fifth Circuit to take the plunge, but the Circuit punted (I love mixing metaphors, don’t you judge me). They can lobby Congress to increase the government’s burden, and whip up public support for it (which is entirely possible), or they can try to get the Supreme Court to reinterpret the Fourth Amendment here (yeah, good luck with that).

But this decision broke no new ground. It did not give law enforcement new powers. It did not undermine the Fourth Amendment.

Please, if you’re going to get up in arms about it, do so for the right reasons. Not because you didn’t understand what happened in the first place. And don’t misrepresent what happened to try to foment misinformed popular outcry.

I’m looking at you, New York Times.

*Not the same as national security or intelligence, by the way, but that’s a whole nother discussion.

Cell Site Data — Is a Warrant Really Required?

Monday, March 23rd, 2009

cell-tower.png

The 3rd Circuit is hearing an interesting appeal on whether the government needs to get a warrant before demanding cell site data from phone companies.

Cell sites are those transmitters you see on rooftops and towers, beaming and receiving cell phone communications. Their range varies from a few blocks to a circle twenty miles across, depending on their power and local geography. When a cell phone is being used, it’s communicating with a particular cell site.

Phone company records will show what cell site was being used by a particular phone at any given time. Law enforcement often requests such records, to help narrow down possible locations for an individual using a phone. This can be particularly useful if the individual is in motion, because his signal will be picked up by a series of cell sites, which can be used to map his progress.

This is passive data, as opposed to an active “ping” whereby a signal is sent directly to a particular phone for the purpose of identifying its location.

Most phone companies will not provide real-time cell site data to law enforcement without a court order. So court orders are routinely sought, often in conjunction with pen registers (calling records which show the time and phone number for calls sent and received). 18 U.S.C. § 2703 permits such an order when there are “specific and articulable facts showing that there are reasonable grounds to believe that… the records… are relevant and material to an ongoing criminal investigation.” These are called 2703(d) orders, and are different from eavesdropping warrants requiring probable cause.

In this case, the feds asked for a 2703(d) order, but unusually did not seek real-time cell site info. Instead, they asked for an order permitting them to get historical data. They’d been investigating drug trafficking, and were tracking one subject’s phones already. During the investigation, they identified what they believed to be the phone of their subject’s supplier. Physical surveillance proving difficult, the feds wanted to see historical cell site data, to see if they could figure out how the supplier had moved around.

The magistrate denied that request, holding that a request for real-time data would have been fine, but that historical data is not permitted pursuant to a 2703(d) order.

(As an aside, the investigators learned of the supplier’s number in June 2007, but didn’t apply for the historical data until February 2008. We know the feds take an inordinate amount of time in their wire and pen applications — one reason why they do comparatively few of them — but eight or nine months is astonishing.)

The feds appealed to the district court, arguing that the magistrate’s decision was bizarre. Instead, however, the district court went further than the magistrate had, and ruled that a warrant based on probable cause would be required for such historical records.

Although we are on the defense side, it seems as though both the magistrate and the district court judge got things backwards. Real-time cell site data, one would expect, is significantly more intrusive of privacy than historical data from up to six months ago. Real-time data can be used to locate where a person is now. The law clearly permits this more invasive search to be performed with a mere order. To require a probable cause warrant for the clearly less-invasive search makes little sense.

The ACLU, meanwhile, has stepped in with an amicus brief opposing the government. They basically argue that, yes, a 2703(d) order would have been sufficient, but the magistrate had the discretion to require a probable cause warrant instead. They then argue that, no, a 2703(d) order would not have been sufficient, and in fact a probable cause warrant ought to be required for all cell site information. People don’t know their cell site data is being collected, so they have an expectation of privacy.

We’re frankly not thrilled with the quality of either side’s brief. But the ACLU wins the “silliest syllogism” award for this one: They hypothesize a subject named Bob. Bob is talking on his cell phone as he enters his office, so with real-time cell site info the police now know he’s in his office. Bob is surveilled to his house. Once inside his house, he makes another call. But without the cell-site info, the cops would have no reason to believe the cell phone never left Bob’s office. Riiiight.

This is a case of first impression in the Third Circuit. One could easily see them ruling against the feds, too.

Feds who, by the way, brought this on themselves.

Seriously. They could have simply subpoenaed the historical business records without going to a judge in the first place. Asking permission to do something novel is the best way to create a precedent saying you can’t do it. But subpoenaing already-existing business records from phone companies is strictly routine. If they’d done it that way, we’d wager that the court would even have compelled the phone company to comply, if the need arose.