{"id":17701,"date":"2020-02-11T10:45:33","date_gmt":"2020-02-11T18:45:33","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2020\/02\/11\/news-11436\/"},"modified":"2020-02-11T10:45:33","modified_gmt":"2020-02-11T18:45:33","slug":"news-11436","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/02\/11\/news-11436\/","title":{"rendered":"Can the Government Buy Its Way Around the Fourth Amendment?"},"content":{"rendered":"

<\/p>\n

Credit to Author: Gilad Edelman| Date: Tue, 11 Feb 2020 12:00:00 +0000<\/strong><\/p>\n

Gilad Edelman<\/span><\/a><\/span> <\/span><\/p>\n

Immigration authorities are purchasing cell phone location data, and it might be totally legal.\u00a0\u00a0<\/p>\n

Last Friday, The Wall Street Journal<\/em> revealed<\/a> that the Department of Homeland Security has been using commercially available cell phone location records for immigration and border enforcement. US Immigration and Customs Enforcement, the paper reported, has used the data \u201cto help identify immigrants who were later arrested,\u201d while Customs and Border Protection uses it \u201cto look for cellphone activity in unusual places.\u201d<\/p>\n

On the one hand, the news is kind of a duh.<\/em> If you\u2019ve been following privacy issues at all in recent years, you know that websites and smartphone apps are sharing your detailed location information with data brokers and advertisers. Why wouldn\u2019t<\/em> law enforcement want to take advantage of that trove of surveillance intel? On the other hand, while the extent and specific details of the DHS program remain unclear, its existence raises a much broader set of questions. There\u2019s nothing stopping other law enforcement agencies from making use of these data sets. (The exception is Utah, which passed<\/a> a 2019 privacy law requiring police to get a warrant for certain types of online data.) The Fourth Amendment is supposed to prevent government officials from tracking our every move. Can they really just buy their way around the Constitution?<\/p>\n

The Fourth Amendment gives the people the right to be free from \u201cunreasonable searches and seizures.\u201d Applying that rule to location data generated by the devices we carry with us 24\/7, however, is still very much a work in progress. The question first came up at the Supreme Court only two years ago, in Carpenter v. United States<\/em><\/a>, and the answer was limited to a specific category of data known as cell site location information, or CSLI. To tie Timothy Carpenter to a string of robberies\u2014of cell phone stores, neatly enough\u2014the FBI in 2011 subpoenaed his cell-tower location records, which placed him near the scenes of the crimes. The government argued that it didn\u2019t need to get a warrant because of the so-called third party doctrine, which says that you surrender any expectation of privacy when you share information with a third party.<\/p>\n

The Supreme Court disagreed. In a landmark ruling<\/a>, Chief Justice John Roberts sided with the court\u2019s four liberals to hold that the third-party doctrine, which was established in the 1970s, simply doesn\u2019t make sense for information as sensitive and revealing as CSLI. \u201cWhen the government tracks the location of a cell phone it achieves near perfect surveillance,\u201d Roberts\u2019s majority opinion explained. Despite the sweeping language, however, the ruling was narrow: If the cops want to get seven days\u2019 worth or more of individual location records from the likes of AT&T or Verizon, they need to come up with a warrant. Roberts left open what should happen in other scenarios, including cell-tower dumps, in which cops can request records of every mobile phone at a particular location over a certain time period.<\/p>\n

Meanwhile, CSLI is far from the only type of location data available today, and wireless carriers are far from the only entities keeping track of our whereabouts. Software development kits embedded in thousands of apps, even ones that have no obvious need to know where its users are located, are gathering and selling that information across the digital advertising landscape. It comes not from cell tower pings but from things like GPS tracking and IP addresses. It\u2019s purchased in bulk and often \u201canonymized,\u201d or stripped of identifying info\u2014although, as a recent New York Times<\/em> report illustrated<\/a>, it\u2019s trivially easy to connect anonymized bulk location data back to individual cell phone users.<\/p>\n

\u201cIf the Department of Homeland Security was going straight to the companies to get this stuff, there would be a bar on them voluntarily disclosing or selling it to DHS.\u201d<\/p>\n

Nathan Freed Wessler, ACLU<\/p>\n

The bigger twist here is that, unlike in Carpenter,<\/em> DHS isn\u2019t subpoenaing location records; it\u2019s buying<\/em> them from Venntel, a data broker that according to the Journal<\/em> has ties to Gravy Analytics, a major adtech company. Does the Fourth Amendment, or any other legal protection, even apply to this type of transaction?<\/p>\n

Nathan Freed Wessler, the ACLU lawyer who successfully argued Carpenter\u2019s case at the Supreme Court, said there are at least two ways in which this arrangement could violate the law. The first concerns the companies originally gathering location data, rather than the government. Under the Stored Communications Act of 1986, companies that store and transmit user data are generally prohibited from \u201cknowingly\u201d sharing those records with the government. That, Wessler said, probably doesn\u2019t apply to a broker like Venntel that doesn\u2019t deal with consumers directly. But it could apply to the app makers who are passing data along to companies like Venntel, if they know it will eventually end up in the government\u2019s hands.<\/p>\n

\u201cIf the Department of Homeland Security was going straight to the companies to get this stuff, there would be a bar on them voluntarily disclosing or selling it to DHS,\u201d he said on Friday. \u201cWhat happens if the weather app is selling it to some location aggregator, but they know that one or two or three steps down the chain of contract, DHS is buying it? Are they knowingly divulging it to a government entity? After today\u2019s Journal<\/em> story, if I was a lawyer at one of those companies, I would be sweating. It\u2019s a really substantial question.\u201d<\/p>\n

Then there\u2019s the Fourth Amendment issue. In Carpenter,<\/em> the court held firmly that just because we let companies access our phone location, that doesn\u2019t give the government carte blanche to access it. \u201cWhat courts haven\u2019t encountered yet is whether a law enforcement agency can evade the warrant requirement by paying money,\u201d Wessler said. \u201cAnd whether the fact that a company will take that money somehow means the Fourth Amendment doesn\u2019t apply.\u201d<\/p>\n

The threshold question in Fourth Amendment cases is whether the government\u2019s activities constituted a \u201csearch.\u201d The Supreme Court has no clear test for answering that question. Instead, judges ask whether the defendant had a \u201creasonable expectation of privacy\u201d\u2014a cross between public policy judgment and sociological interpretation. In Carpenter,<\/em> the answer was yes: cell phones are so \u201cindispensable to participation in modern society,\u201d the court held, that it would be unreasonable to make Americans give up their privacy in order to use one.<\/p>\n

We don\u2019t know exactly how DHS is using the data it buys. A CBP spokesman told the Journal,<\/em> \u201cWhile CBP is being provided access to location information, it is important to note that such information doesn\u2019t include cellular phone tower data, is not ingested in bulk and doesn\u2019t include the individual user\u2019s identity.\u201d But the key point of the Carpenter<\/em> ruling is to limit the government\u2019s capacity to obtain a comprehensive log of Americans\u2019 location without having to show probable cause. If a government agency is using data location records to isolate the movements of specific individuals, then that same logic would seem to apply. The location tracking made possible by app data in 2020 is more precise and potentially even more comprehensive than the cell tower data that the FBI used back in 2011. Giving government as much access as it can buy raises the same prospect of \u201cnear perfect surveillance\u201d that Roberts warned about. Similarly, it\u2019s basically impossible to completely opt out of our location being tracked. \u201cOnly the few without cell phones could escape this tireless and absolute surveillance,\u201d as Roberts put it in Carpenter.<\/em> The impact on privacy would seem to be the same whether the government is subpoenaing the data or buying it.<\/p>\n

\u201cWe don\u2019t want to live in a world where, in the absence of a statute on point, the government can just buy its way around the Fourth Amendment,\u201d said Wessler. \u201cBut, admittedly, the courts haven\u2019t answered that question. And it\u2019s a really substantial one.\u201d<\/p>\n

There\u2019s no way to know how the Supreme Court would resolve a case raising these issues\u2014a process that would take years. And that\u2019s assuming there even is<\/em> a case. One thing that makes it so hard to challenge this sort of surveillance is that defendants may not even know the government used it against them. That\u2019s also true on a societal level. We now know that DHS is using commercial location data for immigration enforcement. But what about other federal agencies, not to mention the thousands of police departments around the country? Aside perhaps from tight budgets, there\u2019s nothing stopping them from making use of data available on the open market.<\/p>\n

Then there\u2019s the fact that the Supreme Court has declared that it wants to move slowly and cautiously on adapting the Fourth Amendment to changing technological circumstances. It\u2019s a reasonable position, but it makes it even more unlikely that the judiciary will be able to keep up with facts on the ground. Ultimately, then, this is probably a problem for Congress to solve. The Constitution is a legal floor, but statutes can add more rights on top of it. The Senate has been making noises about passing federal privacy legislation this year, though the possibility still seems remote. The DHS story is just the latest example of how important it is for lawmakers to get their act together. If they don\u2019t, we may find out exactly how much our privacy was worth.<\/p>\n

https:\/\/www.wired.com\/category\/security\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Gilad Edelman| Date: Tue, 11 Feb 2020 12:00:00 +0000<\/strong><\/p>\n

Immigration authorities are purchasing cell phone location data, and it might be totally legal.\u00a0\u00a0<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10607],"tags":[714,21382],"class_list":["post-17701","post","type-post","status-publish","format-standard","hentry","category-security","category-wired","tag-security","tag-security-privacy"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=17701"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17701\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=17701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=17701"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=17701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}