Warrantless GPS Phone Tracking

[TheCotMan]

URL1=http://www.wired.com/threatlevel/2012/08/warrantless-gps-phone-tracking/

Judge John M. Rogers wrote for the majority: (.pdf)

If a tool used to transport contraband gives off a signal that can be tracked for location, certainly the police can track the signal. The law cannot be that a criminal is entitled to rely on the expected untrackability of his tools. Otherwise, dogs could not be used to track a fugitive if the fugitive did not know that the dog hounds had his scent. A getaway car could not be identified and followed based on the license plate number if the driver reasonably thought he had gotten away unseen. The recent nature of cell phone location technology does not change this. If it did, then technology would help criminals but not the police.

This is an interesting rationalization of why this justice believes use of GPS information from phones as not requiring a warrant.

Using the "scent" metaphor, content that is passed on wireless networks can be legally read and examined by people too. We have no control over what we smell. When we are at any location, whatever smells are in the air, are what we smell. So, when you are in Starbucks and happen to "sniff" a wireless network, grabbing usernames and passwords or other credentials, is this, too acceptable? How invasive can we be to gather such information? Is passive the only method we can legally use?

This would also suggest the google "war driving" and capture of wireless access point content, and location information for each access point is legal, as their receiver is only "sniffing" what is in the air, and the government's view is that is not protected by any privacy restrictions for law enforcement. (A view for this: Either "private" information is protected, or it is not. If we view information a not protected by privacy laws when law enforcement seeks to examine it, then should the same information also not be protected by privacy laws when non-law enforcement citizens also review the same data?

I am not well versed in Cell phone communication. I have read a little bit on data communications on different mobile networks as part of working with kernel drivers for broadband cards for Internet access, but am no expert. Just because I do not know of GPS information being passed as a routine part of phone network communication at Layer 2 does not mean it does not exist. I'll work on the assumption that GPS location information is NOT required a a transmitted part for "normal" cell phone communication with any provider. (GPS Information was not required in cell phones that did not have GPS receivers, so it should not be required now.)

Some applications on modern phones transmit location information with applications like those that use maps.google.com. Use of these kinds of applications do transmit GPS data at Layer 7 as a normal part of operation, and the default is to leave this enabled.

Let's assume that a phone is configured to use no GPS-enabling applications downloaded/installed by the owner, and the owner has disabled the option to allow applications access to GPS information. (Layer 7 and OS permissions.)

Let's also assume the phone does not transmit GPS location information as part of operating on the mobile network. (Layer 2)

Let's also assume most phones have a GPS receiver to compute location, and this information is available to the phone's OS. (Layer 1)

Would this court decision make it legal for Law Enforcement to demand a mobile service provider use any installed software backdoors (for diagnostics, trouble shooting, maintenance loop, etc.) such as Carrier IQ ( URL2=http://www.washingtonpost.com/business/technology/what-is-carrier-iq/2011/12/01/gIQApql1GO_story.html ) to force your phone to transmit its present GPS location information even if:
1) You have configured it to not be used (or)
2) You are not presently using it?

As many of you know, extended use of GPS features with things like "maps.google.com" can be a significant drain on your phone's battery. Also, asking a phone to receive and send data not requested by the owner is a theft of service. It seems to me that this makes it legal for law enforcement to commit "theft of service" by proxy without the strict judicial oversight as required by warrants.

If Law Enforcement are not the ones actually performing the request for location information, but the mobile network provider is performing this check, and this is part of their ToS and contract, is this a legal allowance by proxy?

What about applications that a user chooses to install? Many applications support using GPS data. If the vendor of these applications decides to cooperate with law enforcement, or decides to not legally challenge requests, and instead give-in, is use of their backdoors to pull location information from any user legal, if allowed in the Terms of Service?

If any other citizen attempted to access your computer/phone OS without permission, they would likely risk violating laws like the computer fraud and abuse act.

Considering these, would one branch of the government even consider saying, "no," to a Law Enforcement request of location data from another branch of the government?

URL3=http://www.nytimes.com/2011/05/10/us/10safety.html (May 9, 2011) (Last year)

[Emergency Alert System] service in those cities is scheduled to start late this year as a prelude to nationwide service next year, perhaps as early as April. To receive the alerts, users must have mobile phones with a special chip, which is currently included in some higher-end smartphones like the latest iPhones. The service will also require a software upgrade.

A thought with this service (as part of news last year) would be to notify smart phone users of emergencies in their area. A cost of signing up for this kind of service could be allowing the federal government to force your phone to transmit its location information. If installation becomes mandatory (like FCC imposed "Emergency Alert System" announcements and tests on broadcast TV) then risks for a long term consequence should be obvious.

URL4=http://slashdot.org/topic/bi/microsoft-and-nypd-pair-for-data-fed-monitoring-system/

“What you’re seeing is what the private sector has used for a long time… If you walk around with a cell phone, the cell phone company knows where you are… We’re not your mom and pop’s police department anymore.”

In the past, some courts have considered "envelope information" (address of intended recipients and claimed sender) are "free for use without warrant." Many of these cases also claim that the contents of these private messages would be protected.

From this, if GPS location information is transmitted as a normal part of a phone's operation at layer 2, and it is legally considered to be, "envelope information," then it might make sense for the court to find in favor of making this information available to law enforcement without warrant.

Returning to the specific case:
URL5(PDF)=http://www.ca6.uscourts.gov/opinions.pdf/12a0262p-06.pdf

Believing that Big Foot was carrying the 6447 phone, authorities obtained an order from
a federal magistrate judge on July 12, 2006, authorizing the phone company to release
subscriber information, cell site information, GPS real-time location, and “ping” data for
the 6447 phone in order to learn Big Foot’s location while he was en route to deliver the
drugs.
That same day, agents “pinged” the 6447 phone and discovered that it was
currently located in Candler, North Carolina, the location of West’s primary residence.
...
By continuously “pinging” the 6820 phone, authorities learned that Big Foot left
Tucson, Arizona on Friday, July 14, 2006, and was traveling on Interstate 40 across
Texas.

From this description, this is an active request by the carrier, asking the phone to provide its location information. From this description, this is NOT a required or incidental part of Layer2 mobile network communication, as an extra, active step is required to ask the remote device to transmit GPS location data in the ping.

Because authorities tracked a known number that was voluntarily used while
traveling on public thoroughfares, Skinner did not have a reasonable expectation of
privacy in the GPS data and location of his cell phone. Therefore, suppression is not
warranted and the district court correctly denied Skinner’s motion to suppress

This opens an interesting door. If there is NO reasonable expectation to privacy for active requests for information from a phone, then any ordinary citizen may be able to track anyone else using the same method, and use this in court for other reasons. Maybe demonstration of violation of restraining orders, or for thieves to identify when home owners are not home, or near their home, and how soon they will be back, with proximity alerts.

The concept of "no expectation of privacy" is a double-edged weapon that can be used against everyone, and decreases overall security by exposing previously secret information as legally obtainable and usable in court.

Feel free to comment about security implications, risks to privacy,

Please avoid making this political. Some ideas on how to avoid making things too political, see our evolving thread where we try to identify what is "too political."

[wrøng!]

Re: Warrantless GPS Phone Tracking

Both analogies imply that the individual is guilty and the pursuit is a reaction to a crime that has just taken place. They were SEEN fleeing in the getaway vehicle, or the WERE A FUGITIVE escaping from custody. With warrantless tracking they are not establishing this restriction.

[GuloGuloDesu]

Re: Warrantless GPS Phone Tracking

Both analogies imply that the individual is guilty and the pursuit is a reaction to a crime that has just taken place. They were SEEN fleeing in the getaway vehicle, or the WERE A FUGITIVE escaping from custody. With warrantless tracking they are not establishing this restriction.

I completely agree with this. In the cases with dogs, and license plates that is all probable cause. With cell phones it is a needle in a haystack. I think that this will become a way of tracking everyone to monitor for a crime, rather than tracking "known criminals".
Just a quick hypothetical:
A bank is robbed, and the thieves have been able to avoid getting captured right away. Now the police go to the phone company and ask for a list of cell numbers that were in or around the bank that was robbed. Now the police ask for the current location data of all of those cell numbers, and then ask for the history of where those phones have been.
If the bank robbers had a cell phone on them, it shouldn't be all that hard to catch them. But what about the invasion of privacy for the 30 other people in the bank? What about you're innocent until proven guilty?
Even though this could be a great tool for LE to use, I personally do not want to give up my privacy, or risk to privacy for this added tool.

[Tony Stark]

Re: Warrantless GPS Phone Tracking

Here in the US Justice Department has refused to release GPS tracking memos.

Two key memos outlining the Justice Department’s views about when Americans can be surreptitiously tracked with GPS technology are being kept secret by the department despite a Freedom of Information Act lawsuit filed by the ACLU to force their release.

[Thorn]

Re: Warrantless GPS Phone Tracking

Previously, I'd missed this thread, but since it seems to be starting up again, I went back and read the stories and the PDFs. One thing that struck me was that in the opinion the judges specifically stated that the defendant (Skinner) lacked standing:

Skinner lacked standing to assert a Fourth Amendment protected interest because the cell phone was not subscribed to him and was used as part of a criminal scheme. The magistrate judge further opined that because the cell phone was utilized on public thoroughfares and was “bought by a drug supplier and provided to . . . Skinner as part and parcel of his drug trafficking enterprise...

In other words, any Fourth Amendment issues about the phone weren't Skinner's to assert in the first place for the simple reason that the phone wasn't his, and it had been provided as part of a criminal conspiracy.

Both analogies imply that the individual is guilty and the pursuit is a reaction to a crime that has just taken place. They were SEEN fleeing in the getaway vehicle, or the WERE A FUGITIVE escaping from custody. With warrantless tracking they are not establishing this restriction.

Actually, both analogies imply "hot pursuit" and "exigent circumstances", not that the subject of the pursuit is guilty. There may be strong indications that they will be found guilty if caught and charged, but there is still a legal presumption of innocence until convicted in a court of law. "Hot pursuit" and "exigent circumstances" don't imply guilt, or even address the probable guilt of a suspect. Rather, they suspend the Fourth Amendment requirements by the police for search warrants under specific emergency circumstances.

For a detailed summary of “hot pursuit” see here: http://legal-dictionary.thefreedicti...om/Hot+pursuit

Here in the US Justice Department has refused to release GPS tracking memos.
Two key memos outlining the Justice Department’s views about when Americans can be surreptitiously tracked with GPS technology are being kept secret by the department despite a Freedom of Information Act lawsuit filed by the ACLU to force their release.

The FOIA doesn’t require the DOJ (or another other goverment agency) to jump just because the ACLU files a request or a lawsuit. There are excemptions to the FIOA. You might want to look at these two in particular:
(b)(5) EXEMPTION - Privileged Interagency or Intra-Agency Memoranda or Letters
(b)(7) EXEMPTION - Investigatory Records Compiled for Law Enforcement Purposes

My guess is that the DOJ is fighting the release under one or both of those exceptions.

[Tony Stark]

Re: Warrantless GPS Phone Tracking

My guess is that the DOJ is fighting the release under one or both of those exceptions.

DOJ needs to disclose how it tracks citizens using GPS and whether citizens will be tracked for months at end or whether the government will first get a warrant.

[Thorn]

Re: Warrantless GPS Phone Tracking

DOJ needs to disclose how it tracks citizens using GPS and whether citizens will be tracked for months at end or whether the government will first get a warrant.

You may have strong opinions about how GPS information is used in investigations, but the courts aren't necessarily going to make those things happen in the way you think they should go.

If you look at case law, the courts generally tend to determine that the techniques be revealed, what standards they must meet (e.g. Daubert v. Merrell Dow Pharmaceuticals if the technique is scientific in nature) and address whether a warrant is needed for the given technique. Furthermore, the case law also tends to dictate what circumstances become exigent and when a warrant may not be required because the cirecumstances don't rise to the needed level. (e.g. Carroll v. United States and Terry v. Ohio.)

However, there's a long history of the courts allowing policing agencies leeway in maintaining secrecy in active investigations. It's extremely rare - almost unheard of - for the courts to require an agency to reveal the subjects of active investigations, even if an investigation goes on for years. Usually, that information becomes public only when charges are brought against an individual, and in the cases of sealed indictments and sealed warrants, revealing the subject of an investigation may not happen until an post-arrest hearing such as an arraignment.

[bluknight]

Re: Warrantless GPS Phone Tracking

Disclaimer: I am speaking only for myself, and my observations about the industries I work in. This does not represent the positions of my employer, even though the thread touches on their operations. That being said...

It should be pointed out that a significant number of subpoenas and warrants served on third parties (such as, say, a telecom provider or ISP) include secrecy provisions that preclude one from revealing to any party, including that being investigated, the existence of said subpoena or warrant. I have observed this in multiple investigatory requests from law enforcement across several different providers.