New Investigation:

How Lax EPA Oversight Enabled Jackson's Water Crisis.

Championing Responsible National Security Policy

Privacy After Carpenter: We Need Warrants for Real-Time Tracking and “Electronic Exhaustion”

Last month, the U.S. Supreme Court ruled in Carpenter v. United States that the Fourth Amendment requires law enforcement to get a warrant before obtaining a person’s historical cell-site location data—location data necessarily created by cellphones as they continuously pings off cell towers, which is then stored by the phone companies. Carpenter is an extraordinarily significant ruling, laying the foundation for privacy rights in the 21st century. However, while the ruling will have substantial immediate impact on protecting Americans’ privacy rights, it leaves several gaps that Congress needs to quickly address.

Most notably, the Supreme Court chose to issue a very narrow ruling and declined to take on real-time location tracking, leaving major loopholes. This was a poor choice.

In terms of the impact of and basis for the Court’s decision, historical versus real-time tracking is a distinction without a difference. Real-time location tracking poses the same threat to privacy, from tracking one person without cause and learning intimate details of their life to the potential that the government could “push a button” and obtain so much information about us that it’s virtually omnipotent. As a result of this decision, a significant amount of cell-site location tracking may continue without a warrant, leading to years of unnecessary privacy invasions and continued litigation.

Further, by shying away from ruling on real-time location tracking, the Court created a perverse incentive for police to ramp up this type of surveillance on a mass scale. After Carpenter, law enforcement must obtain a warrant in order to get historical records of location data, but if police collect real-time location data on a mass scale and then stockpile it, they can then simply refer back to their own databases, looking up desired location information on internal servers and circumventing the warrant requirement.

We should not allow this senseless loophole to stand. Congress should immediately pass legislation to apply the same warrant standard to real-time cellphone tracking that Carpenter established for historical cell-site tracking.

Additionally, police conduct electronic location tracking through a variety of methods, many of which can have a significant impact on the privacy not just of the target, but of all individuals around them. The cell-site tracking at issue in Carpenter is actually less invasive than other cellphone-tracking methods, as it is directly focused on the data of the surveillance target and does not sweep up data from other individuals.

One of the most common methods of location surveillance is through IMSI catchers, commonly called “stingrays.” These devices imitate cell towers and suck up the information of every cell phone in range. (Generally, police use stingrays to collect location data, but they can be configured to snoop on texts and calls.) While stingrays often cover a range of several city blocks, they can be configured to gather location data for a much larger area. Police even place ISMI catchers called “dirtboxes” on planes to pull the location data from every cellphone in an entire city.

In order to address the various impacts of different tracking methods, Congress needs to establish additional rules for electronic location tracking. Most notably, it should enact a version of “exhaustion” requirements for electronic forms of surveillance.

“Exhaustion” is a requirement applied to certain invasive forms of surveillance, notably wiretapping, whereby law enforcement must demonstrate that it first unsuccessfully attempted (“exhausted”) traditional, less invasive investigative methods before asking a court to authorize electronic eavesdropping. However, for location tracking, an additional question must be asked: Has law enforcement exhausted less invasive electronic surveillance methods before moving on to the one it is requesting?

Requiring law enforcement to answer this additional question is critical because of the range of electronic location tracking methods at its disposal and the extent of collateral damage to privacy these methods can cause.

Even if Congress sets a consistent warrant requirement for all forms of real-time cellphone tracking, law enforcement shouldn’t be permitted to use location-surveillance techniques that gather sensitive information of hundreds, sometimes even thousands, of innocent individuals if an electronic location tracking method that causes no collateral damage would be effective, i.e. focused cell site tracking. In addition to preventing unnecessary invasions of privacy, this would safeguard First Amendment-protected activities. Even if the government obtains a warrant, absent electronic exhaustion rules, probable cause against one individual could be used as a pretext to place stingrays at protests, political rallies, or religious ceremonies. The result could be the cataloging of the involvement of all individuals in these situations rather than limiting surveillance exclusively to a single target.

Electronic exhaustion would prevent this sort of broad invasion of privacy. It would require the government to demonstrate that limited location-tracking techniques like cell-site tracking, which only affect the target, would fail before it can move to more expansive methods like stingrays. This would ensure that these particularly invasive surveillance tools are only used when they are truly the only method that would be effective (such as when police need to pinpoint an individual inside a building).

In the exceptional case where law enforcement is authorized to deploy extra-invasive location surveillance tools, the law should limit how much data these tools collect. Even when electronic exhaustion does permit use of location surveillance that affects non-targets, this restriction should require that this surveillance occur over the smallest-possible geographic area and span of time. A stingray flying above in a plane should never be used to collect an entire city’s data if using one on the ground focused on a single building would be sufficient for an investigation where, for example, police are trying to pinpoint a suspect’s apartment. And one shouldn’t be used for several hours when several minutes of data gathering would be sufficient.

There are a host of measures Congress should enact regarding location privacy following the Carpenter decision, and it should do so quickly. A consistent warrant rule for all cellphone tracking and an electronic exhaustion requirement should be its top priorities. The protections established in Carpenter will be severely undercut if police can use stingrays en masse absent any suspicion, or sweep up and store hundreds of people’s location data every time it obtains a warrant focused on a single individual.

Privacy and civil liberties advocates should be pleased with the Supreme Court’s ruling, but our work—and Congress’s—in establishing proper safeguards for location privacy is far from over.