Supreme Court Limits Government Access to Cell Phone Tracking Data

My latest post on the Specialty Technical Publishers "Audit, Compliance and Risk Blog." STP publishes Internet Law: The Complete Guide, of which I am the lead contributor and editorial reviewer.

We all—well, almost all of us—have devices with us at all times, which track and keep a record of our location. This isn’t some government mandate or a dystopian sci-fi novel. Indeed, we do this willingly, and even pay for both this device and the service that tracks us.

You know this device as your cell phone.

In order for it to make and receive calls, every cell phone—even the “dumb” ones—regularly “pings” nearby cell antennas. In addition to telling the system which antenna(s) to route any calls through, this also provides an approximate location of the phone. Most smartphones take this further by including Global Positioning System (GPS) technology that can pinpoint the phone’s location within four meters (about 4.4 yards), although this varies according to terrain and other conditions.
Of course, this ability to locate a phone has a number of useful purposes, including navigation and locating someone in an emergency. But it also raises questions of privacy over who has access to this location data, both in real time—where the phone, and likely its owner, is right now—and in historical data, where the phone and its owner have been.

The United States Supreme Court recently wrestled with these questions for its decision in Carpenter v. United States.

In this case. Timothy Carpenter was identified as an accomplice in robberies of several Radio Shack and T–Mobile stores in Detroit. Prosecutors applied for court orders to obtain cell phone records for Carpenter and the other alleged accomplices under the federal Stored Communications Act, which permits the government to compel the disclosure of certain telecommunications records, obtaining a subpoena when it offers to the court “specific and articulable facts showing that there are reasonable grounds to believe” that the records sought “are relevant and material to an ongoing criminal investigation.”

Federal magistrate judges issued orders directing Carpenter’s wireless carriers to disclose the location of his cell phone during the four-month period when the robberies occurred. Altogether, the government obtained data on Carpenter’s location at 12,898 points, an average of 101 data points per day.

Carpenter moved to suppress the cell location data, arguing that the government’s seizure of the records violated the Fourth Amendment because they had been obtained without a warrant, which requires a showing of probable cause, rather than the “reasonable grounds” standard required by the Stored Communications Act. The district court denied the motion and Carpenter was found guilty.
On appeal, the Sixth Circuit affirmed the use of the cell phone records, holding that Carpenter did not have a reasonable expectation of privacy in his location because he had voluntarily shared this information with his cell phone carriers. Because he had voluntarily shared this data (as a requirement for receiving cell service), a legal principle known as the “third-party doctrine” applied, and Carpenter had no expectation of privacy in the location data.

The Supreme Court, however, in a 5-4 decision, reversed. In his majority decision, Chief Justice Roberts wrote: “Given the unique nature of cell phone location records, the fact that the information is held by a third party does not by itself overcome the user’s claim to Fourth Amendment protection.” In short, the majority held that “an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI [cell-site location information].”

The effect of this ruling is that the “third-party doctrine” which previously had been cited by courts, including the Supreme Court, to defeat privacy claims, does not apply to cell phone location data. The ruling also requires police to obtain a warrant in order to access such information, which requires a higher standard of suspicion than is required for a subpoena under the Stored Communications Act. However, Justice Roberts was careful to limit application of the ruling, saying that it was not applicable to real-time cell location data or records of all the devices that connected to a particular cell antenna at a particular time. He also wrote that the decision did not apply to conventional surveillance techniques and tools, such as security cameras, or collection techniques involving foreign affairs or national security.

There were several dissents. In a decision written by Justice Anthony Kennedy, three of the dissenters said that the majority’s ruling was a “departure from relevant Fourth Amendment precedents and principles” of the third-party doctrine. “Cell-site records,” Kennedy wrote, “are no different from the many other kinds of business records the government has a lawful right to obtain by compulsory process.” Justice Clarence Thomas emphasized in his separate dissent that the records belonged to Carpenter’s cell phone providers, not to him.

Justice Neil Gorsuch’s dissent took the opposite position: that the phone records, while in the possession of third parties, could perhaps be considered Carpenter’s own property. However, he added that since Carpenter had not made this argument, he was compelled to agree with the appellate court. Justice Samuel Alito’s dissent, joined by Justice Thomas, said that the lower proof standard should apply because the materials sought were records and did not constitute a personal search.

The majority’s ruling, on the other hand, emphasized “the deeply revealing nature of CSLI, its depth, breadth, and comprehensive reach, and the inescapable and automatic nature of its collection,” and the conclusion that the government should not have “unrestricted access” to cell phone companies’ databases of physical location information. “[T]he fact that such information is gathered by a third party does not make it any less deserving of Fourth Amendment protection.”

This means that police agencies must go to court and obtain a warrant before accessing cell phone location records, giving cell phone users some privacy protection against tracking of their every move.