The Law of Government Access to Location Data: Protecting Mobile Privacy

1. The Law of Government Access to Location Data Nicole A. Ozer, Esq. Technology and Civil Liberties Policy Director ACLU of Northern California Links to materials @nicoleozer

2. If you collect location data, law enforcement will eventually come knocking… • LE aggressively trying to access location data across the country • Recent ACLU nationwide PRA- 32 states, 205 agencies – only 10 responded that they don’t engage in cell tracking (half in NJ)

3. Legal Standards Employed to Access Location Data Vary Widely • “Warrant based on probable cause, as required by law” including County of Hawaii, North Las Vegas, Nevada • Historical cell site records when “relevant to an ongoing investigation” - Wilson County, NC • “…comply with whatever the provider requests” – Weber County, Utah

4. Good Reason for Business and Personal Concern and Movement on Mobile Privacy • Constitutional protections inconsistently applied • Statutory protections outdated

5. Why Not Consistent? Constitutional Protection The Fourth Amendment Clearly Protects Data: • At home or on a device in your possession • Judicial search warrant (probable cause) • Notice at time of search BUT what about if in another’s hands • Couch (accountant) • U.S. v. Miller (bank) • Smith v. Maryland (telephone company) “third party” or “business records” doctrine- established in the 1970s.

6. Fitting Mobile Privacy Into Outdated Statutes 2004: Facebook launched 1998: Google founded 1994: Yahoo & Amazon founded 1990: World Wide Web created & cell phones the size of bricks 1986: ECPA U.S. Electronic Communications Privacy Act

7. In 1986, cell phones looked like this… • “electronic communication service • or a “remote computing service” ? • Is all location data collected by LBS “content” or “transactional data”? • Does the fact that cell phones automatically transmit information make them “tracking devices” subject to a standard of probable cause?

8. Courts Split on Location Info… SDNY- Compare 460 F. Supp. 2d 448 (S.D.N.Y. 2006) (Kaplan, D.J.) (permitting real time tracking w/o probable cause) ; 2009 WL 159187 (S.D.N.Y. 2009) (McMahon, D.J.) (probable cause required for real time tracking). EDNY-Compare 396 F. Supp. 2d 294 (E.D.N.Y. 2005) (Orenstein, M.J.) (probable cause for prospective tracking) and 2009 WL 1530195 (E.D.N.Y. 2009) (Pollak, M.J.), (probable cause for prospective tracking, reversed by Judge Garaufis) with 2009 WL 1594003 (E.D.N.Y. 2009) (Garaufis, D.J.) (no probable cause necessary for prospective tracking) Third Circuit – Can require probable cause search warrant before accessing cell phone location data. September 7, 2010. Fifth Circuit- Texas district court judge- warrant required for 60 days of historical cell data- currently on appeal to Fifth Circuit

9. U.S. v. Pineda-Moreno. (9th Cir. 2010) 591 F.3d 1212 (warrantless installation of GPS device on undercarriage of car while in defendant’s driveway constitutional). • United States v. Maynard, 615 F.3d 544 (D.C. Cir. 2010) • rehearing denied 5-4, March 2010 (warrantless installation of GPS device unconstitutional- mosaic theory). • The sequence of a person’s movements can reveal still more; a single trip to a gynecologist’s office tells little about a woman, but that trip followed a few weeks later by a visit to a baby supply store tells a different story. A person who knows all of another’s travels can deduce whether he is a weekly church-goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups- and not just one such fact about a person, • but all such facts.

10. January 23, 2012- Bit More Clarity • Supreme Court upholds DC Circuit in U.S. v. Jones- unanimously rules police violated Constitution when placed GPS device on car and monitored 28 days – split reasoning • Alito concurrence urges legislative action “best solution” to address technological change • Sotomayor concurrence questions 3rd party doctrine “may be necessary to reconsider…ill suited to the digital age.”

11. Federal Movement • Bipartisan GPS Act- warrant protection, consent before business collection. Wyden/Kirk, Chaffetz/Sensenbrenner • Update ECPA – Leahy. Hearings in House/Senate • Mobile privacy hearings in Senate – Franken • FTC/FCC roundtable on mobile location, Commerce/White House- mobile will be early on the agenda

12. State Movement • 11 States considering location-related bills, including California • Require a probable cause warrant for GPS • Require a probable cause warrant for all location data – historical and perspective

13. Position Your Company • Build in the policies- Come Back With a Warrant! • Support Privacy Law Upgrades • Design for Privacy - business case studies and tips at www.dotrights.org/businesses • “The last thing these companies want is for people to be afraid of their phones” - Chaffetz

14. Links to materials @nicoleozer www.aclunc.org/tech Nicole A. Ozer, Esq. Technology and Civil Liberties Policy Director ACLU of Northern California