Adventures on the autobahn and infobahn: United States v. Jones, mandatory data retention, and a more reasonable 'reasonable expectation of privacy.'(Symposium on Cybercrime)

• Author: Stratford, John A.

1. INTRODUCTION

   On July 28, 2011, the House Judiciary Committee voted nineteen to ten in favor of passing H.R. 1981, also known as the Protecting Children from Internet Pornographers Act of 2011. (1) Among other provisions aimed at stamping out child pornography on the Internet, one particular section of the bill stirred up a maelstrom of controversy among privacy and civil liberties advocates. The provision required every Internet service provider (ISP) to retain, for a period of at least eighteen months, certain information about every user of its service in order to allow law enforcement to access records of suspected child pornographers. (2)

   Many of the same privacy advocates eagerly awaited last year's decision in United States v. Jones. (3) In Jones, the Supreme Court considered whether extended warrantless GPS tracking of a vehicle by law enforcement violates the Fourth Amendment. (4)

   These two hot-button issues both present concerns about privacy and how courts should regulate interactions between individuals and the government. In this Comment, I argue that these two controversies--one involving surveillance of Internet users on the infobahn and one involving surveillance of drivers on the autobahn--represent and illustrate the same underlying problem with current Fourth Amendment jurisprudence: the "assumption of risk" doctrine first articulated in Katz v. United States, (5) I further contend that this doctrine is misguided and has become untenable in modern society. Under a modified Katz test, setting aside the assumption of risk doctrine, citizens have a reasonable expectation of privacy both in user data retained by ISPs and in the totality of the movements of their vehicles. The modified Katz test proposed here renders both of these regimes presumptively unconstitutional. Such a modified test would at the very least begin the process of bringing the Court's Fourth Amendment jurisprudence back in line with the fundamental principles behind that Amendment.

   Part I briefly outlines the history of and controversy surrounding both mandatory data retention and warrantless GPS tracking in the context of the Court's Fourth Amendment jurisprudence. Part II articulates how these two controversies can be understood as symptoms of the same problem: the assumption of risk doctrine. It then explains why the current state of Fourth Amendment jurisprudence does not provide adequate safeguards for individual privacy and presents the normative reasons supporting a change in the doctrine. Finally, Part III offers a modified "reasonable expectation of privacy" framework that excludes the assumption of risk doctrine. This Part concludes that both mandatory data retention and warrantless GPS tracking raise grave constitutional concerns under such a test. It then addresses concerns about potential future applications of Katz under this test.

2. BACKGROUND

   1. THE FOURTH AMENDMENT AND KATZ V. UNITED STATES

      The Fourth Amendment provides a short and rather vague statement that acts as almost the sole regulation of conduct between individual citizens and law enforcement officers. It provides:

      The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (6) As one commentator notes, "An elaborate regulatory system rests upon this one sentence." (7) The Fourth Amendment regulates a myriad of state--citizen interactions, from more traditional traffic stops, search and frisks, and arrests, to high-tech investigatory actions like wiretaps, Internet surveillance, and GPS vehicle tracking.

      A recurring question of interpretation in this regulatory system is what constitutes a "search" or "seizure" for purposes of the Amendment. If a government action against an individual is not a search or seizure, then the Fourth Amendment inquiry ends and there is no further question of whether the action was reasonable or whether a warrant was required under the Amendment. (8) Early Supreme Court decisions focused on whether or not the government was interfering with property interests when deciding what constituted a search. (9) The meaning of a search soon came to be limited to physical intrusions, a doctrine that culminated in the Court's Olmstead decision in 1928. (10) In that case, the Court held that law enforcement tapping an individual's telephone was not a search because it did not involve a physical intrusion into the home. (11) This decision was immediately criticized for cutting against the normative principles behind the Fourth Amendment. (12) Was tapping a phone really so unlike invading physical property? Could the government simply wait until technology afforded them the means to monitor citizens wholesale while the Fourth Amendment stood idly by?

      Nevertheless, the Court limited Fourth Amendment "searches" to physical intrusions until its landmark Katz decision in 1967. (13) In Katz, the FBI attached a listening device to a phone booth in which the defendant was having a conversation about illegal gambling. (14) They recorded the conversation, having obtained no warrant to do so, and then used the recording against him in court. (15) Katz argued that his Fourth Amendment right against unreasonable searches was violated, and the Court agreed. (16) Rejecting their previous doctrine of physical intrusion, the Court stated, "What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected." (17) The test for exactly what was "constitutionally protected" is now considered embodied in Justice Harlan's oft-quoted concurrence in the case: "My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable.'" (18)

      As the doctrine now stands, then, a search for the purposes of the Fourth Amendment is a government action that infringes a person's "reasonable expectation of privacy." (19) The test has both subjective (an individual's actual expectation of privacy) and objective (whether society deems that expectation reasonable) components. (20) Crucially relevant to this Comment, however, is what may be seen as Katz's exception to the general "reasonable expectation of privacy" test: "What a person knowingly exposes to the public ... is not a subject of Fourth Amendment protection." (21) In the following sections, I show how this part of Katz's holding and its rigid interpretation by the Court has birthed a series of controversial rules surrounding searches and privacy, using mandatory data retention and warrantless GPS tracking as current examples.

   2. MANDATORY DATA RETENTION AND THE THIRD-PARTY DOCTRINE

      Times have changed since Katz was decided in 1967--it is no secret that we now live in an age where Internet use has become ubiquitous and is arguably a necessity for navigating life in modern society. (22) And while the Internet offers unprecedented opportunities for communication, education, business, and entertainment, it is also the greatest aggregator of personal information in human history. (23) As users navigate the Internet, they leave behind a massive trail of data, including e-mail communication, instant messaging, website browsing data, commercial transaction records, and even information about software, hardware, and geographic location. (24)

      It is unsurprising that third parties are increasingly eager to access this virtual treasure trove of personal information. Search engines like Google use it to sell tailored advertising; (25) marketing firms use it to analyze trends in commerce; (26) and, relevant to this Comment, law enforcement uses it to track down criminal suspects.

      In the United States today, most ISPs retain some data about each of their users for a limited period of time. (27) This data might include browsing history, records of e-mail communication, and Internet protocol (IP) addresses. (28) After a time, this information is often deleted. (29) Under current data preservation laws, however, law enforcement officials may require ISPs to retain certain data about specific customers suspected of crimes to assist investigations. (30) The government can force ISPs to retain this data for up to 180 days as part of its investigation. (31)

      H.R. 1981, introduced by Representative Lamar Smith of Texas, would impose a much more severe regime of "mandatory data retention." (32) Under a mandatory data retention program, ISPs (or other telecommunications providers) are required to retain data about every user for a specified period of time. In the case of H.R. 1981, ISPs would have to retain temporarily assigned network addresses of all users for at least one year. (33) Temporarily assigned network addresses are records of IP addresses that the ISP assigns to customers. (34) In combination with other "clickstream" data--like browsing history, commercial transaction records, and communications--these IP addresses would allow law enforcement to effectively identify customers and match them up with a comprehensive record of online activity. (35)

      The bill was supported by the Department of Justice and the International Association of Chiefs of Police. (36) It was met with loud opposition from privacy advocates in the media and within the House of Representatives. The Center for Democracy & Technology, for example, "urge[d] Congress to fully investigate questions about child pornography investigations before it considered] imposing burdensome and costly mandates...