Fighting cybercrime after United States v. Jones.

• Author: Gray, David
• Position: I. Introduction through III. The Government's Legitimate Interests in Preventing, Detecting, and Prosecuting Healthcare Fraud A. Big Data and the Mosaic Theory, p. 745-770 - Symposium on Cybercrime

TABLE OF CONTENTS I. INTRODUCTION II. UNITED STATES V. JONES AND THE MOSAIC THEORY OF FOURTH AMENDMENT PRIVACY III. THE GOVERNMENT'S LEGITIMATE INTERESTS IN PREVENTING, DETECTING, AND PROSECUTING HEALTHCARE FRAUD A. Big Data and the Mosaic Theory B. The Value of Big Data in Combating Healthcare Fraud C. How Big Data Serves Governmental Interests in Preventing, Detecting, and Prosecuting Healthcare Fraud D. Striking a Reasonable Balance Between Privacy Interests and Legitimate Governmental Interests in Preventing, Detecting, and Prosecuting Healthcare Fraud IV. HOW DIGITAL SURVEILLANCE SERVES GOVERNMENTAL INTERESTS IN PREVENTING, DETECTING, AND PROSECUTING CYBERHARASSMENT A. Digital Surveillance and the Mosaic Theory B. The Value of Digital Surveillance in Combating Cyberharassment C. How Digital Surveillance Serves Governmental Interests in Preventing, Detecting, and Prosecuting Cyberharassment D. Striking a Reasonable Balance Between Privacy and Legitimate Governmental Interests in Preventing, Detecting, and Prosecuting Cyberharassment V. CONCLUSION The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (1) I. INTRODUCTION

Until the middle of the October 2011 Term, the prevailing view on how to measure Fourth Amendment interests and where to draw the line between subconstitutional surveillance and a Fourth Amendment "search" focused on identifying "reasonable expectations of privacy." (2) If law enforcement officers did not enter private spaces, intrude on private interactions, or otherwise invade a defendant's subjectively manifested and objectively reasonable expectations of privacy, then they were left to pursue their investigations unfettered by Fourth Amendment constraints or concerns. Even if an investigative method or strategy did invade a person's reasonable expectations of privacy, the Fourth Amendment did not bar law enforcement officers from using it. Rather, the Fourth Amendment required that law enforcement's discretion be limited to ensure a reasonable balance between the government's interests and the privacy interests of those subject to search.

Until relatively recently, the contours of reasonable expectations of privacy, as well as the balance between law enforcement's interests and those of the individual, were fairly stable. In United States v. Jones (3) the Court indicated that the ground has begun to shift. As we have become more dependent on networked devices and as public spaces are increasingly tracked and traced, we expose more of ourselves to governmental actors and to third parties. As Justice Sotomayor noted in Jones, the government, by itself and through its contracted agents, now has access to powerful surveillance technologies and sophisticated software that is capable of aggregating and analyzing massive quantities of data. (4) For the most part, this literally occurs in bits and bytes that mean little when considered discretely. When aggregated together, however, these isolated events produce a revealing and disconcertingly vivid picture of our lives. (5)

Although Jones was resolved on narrow grounds, five Justices took the opportunity to suggest that these new surveillance capacities give law enforcement access to revealing informational mosaics that violate reasonable expectations of privacy and therefore implicate the Fourth Amendment. This "mosaic theory" of Fourth Amendment privacy is novel and will pose serious challenges for law enforcement officials, citizens, and courts if it is ultimately adopted. (6) Meeting these challenges will require, at a minimum, understanding both the privacy interests and the legitimate governmental interests at stake.

The concurring Justices in Jones, joined by academic commentators, (7) have described at length the privacy interests implicated by technologies capable of gathering large quantities of data. Almost absent from the discussion so far, however, has been any accounting of the legitimate governmental and law enforcement interests served by these technologies. That is unfortunate. After all, it is hard to strike a reasonable balance between the competing interests of law enforcement and citizen privacy, as the Fourth Amendment requires, if we lack a clear understanding of those competing interests. Our goal in this Article is to begin filling that void by discussing the role of data aggregation and surveillance technologies in the detection, investigation, and prosecution of cybercrimes.

The social problems constituting "cybercrime" are varied and costly. Take for example cyberharassment, which involves patterns of online behavior that are intended to inflict substantial emotional distress and would cause a reasonable person to suffer substantial emotional distress. (8) Multifaceted and malleable, "[cjyber harassment ... tend[s] to involve explicit or implicit threats, privacy invasions, defamation, data thefts, impersonation, technological attacks, and[] the recruitment of third parties to physically harm victims." (9) Attackers hack into victims' computers to steal revealing pictures and then extort them, threatening to release the pictures unless they agree to the harassers' demands. (10) Vengeful ex-lovers post victims' naked pictures on pornography sites alongside the suggestion that they are interested in anonymous sex. (11) Although some attackers confine their hostile activities to networked technologies, others use all available tools to harass victims, including real-space stalking. (12)

Cyberharassment has a profound impact on victims' lives. It causes debilitating psychological and emotional harm. It damages victims' careers and professional reputations. It interferes with their educations. (13) It silences them, discouraging them from on- and offline pursuits. In addition to psychological, emotional, and social damage, cyberharassment has led to sexual assaults, which are sometimes committed by unwitting third parties. (14)

Although fraud predates the computer by millennia, healthcare fraud provides an example of a traditional crime that has been upgraded and enhanced by new computer and Internet technologies. According to conservative estimates, approximately $60 billion in annual Medicare payments are fraudulent. (15) In sharp contrast, current efforts to prevent, detect, and prosecute healthcare fraud have produced only modest returns, recovering only $4.1 billion in 2011. (16) In addition to monetary costs, healthcare fraud also directly threatens the safety of patients, particularly when schemes result in unnecessary treatments, withholding necessary treatments, or disbursement of improper prescriptions.

There can be no doubt that the government has a compelling interest in detecting and prosecuting cybercrimes like cyberharassment and healthcare fraud. New and developing surveillance technologies, particularly those involving data aggregation and analysis, offer law enforcement officers helpful tools for combating these crimes. At the same time, these technologies implicate privacy interests that would be given Fourth Amendment status under a mosaic theory. In this Article, we explore these competing interests and outline ways that courts, legislatures, and executives might strike a reasonable balance between them. Part II provides a brief historical account of the relevant Fourth Amendment doctrine to put the mosaic theory in context and to explain the challenges it raises for identifying and balancing competing privacy and law enforcement interests. Part III focuses on the government's interest in preventing, detecting, and prosecuting healthcare fraud. Part IV elaborates on the government's significant interests in preventing, detecting, and prosecuting cyberharassment crimes. Part V concludes.

2. UNITED STATES V. JONES AND THE MOSAIC THEORY OF FOURTH AMENDMENT PRIVACY

   To understand the new law enforcement dynamic set to take hold in cybercrime investigations and prosecutions, it is necessary to have a clear understanding of both the balancing test at the core of the Fourth Amendment and how the mosaic theory of Fourth Amendment privacy may put a thumb on that scale. That is the project for this Part.

   As Akhil Amar has explored, agents conducting searches under state authority were subject to civil actions long before 1791. (17) The Fourth Amendment's prohibition on unreasonable searches and seizures draws on this common law history. (18) In fact, for the better part of a century after it was ratified, the Fourth Amendment appears to have been understood largely as a constitutional instantiation of property rights developed and bundled through the common law of trespass. (19) So much so, in fact, that the prevalent remedy for Fourth Amendment violations until Boyd v. United States (20) was an action in tort. (21)

   A trespass-based understanding of the Fourth Amendment may well have served the expectations of those who read the text in 1791. By the early years of the twentieth century, however, limiting the reach of the Fourth Amendment to physical incursions in protected places seemed...