Mapping a way out: protecting cellphone location information without starting over on the Fourth Amendment.

• Author: Leneis, Brad

1. INTRODUCTION

   In the last ten years, a new technology--the cellphone--has penetrated American society. (1) Many Americans no longer talk to one another over hard-wired landline phones--instead, they connect using mobile communications devices. (2) And they connect in a variety of ways: through email, instant messaging, text messaging, and online chat, to name a few. Smartphones with powerful computing abilities have now saturated the market as well. (3) As social media applications, or "apps," proliferate, these phones become all-purpose, real-time communications devices--compact glass windows into the lives of those around us. Small wonder we feel such an intense connection to them. (4)

   This behavioral shift presents challenging new problems for courts and law enforcement alike. Many law enforcement agencies are concerned that the rapid migration to online communication will cause wiretaps, which have long been a critical investigative resource, to "go dark" because people may no longer rely exclusively (or even primarily) on telephones to communicate electronically in real-time. (5) But if the rise of online communication closes some investigatory doors, it opens another: collecting information about people's location and movements on a previously unthinkable scale. As discussed in Part II of this note, the cellphone network generates a vast amount of location information, and the precision of that information continually improves as the demand for mobile services rises. (6) Some of this information is generated when phone users place calls, send texts, or use apps; much more is generated when the phone automatically registers with nearby towers, which happens every few seconds when the phone is on. (7)

   Naturally, law enforcement is very interested in this data because it can provide information about where suspected criminals have been (8) and where they are now. (9) But access to cellphone location data also raises privacy concerns precisely because it is so useful. (10) Part III of this Note assesses the state of the law concerning government access to cellphone location data. That access is governed by several aging federal statutes, discussed in Part III-A, which are backstopped by the Fourth Amendment's prohibition against unreasonable searches and seizures, discussed in Part III-B. Courts have generally held that the statutes provide more protection to real-time location information--that is, information about where a phone is now--than to stored information about where a phone has been. (11) And the Fourth Amendment only provides protection for cellphone location information if users reasonably expect that information to remain private. (12)

   When deciding whether such an expectation is reasonable, courts have wrestled with the implications of the Fourth Amendment's third-party doctrine. (13) Put simply, the third-party doctrine holds that a reasonable privacy expectation cannot attach to information voluntarily revealed to someone else. (14) Part IV examines two recent location information cases and argues that if the third-party doctrine is applied to all cellphone location information, no analytic barrier exists to prevent law enforcement from engaging the type of "dragnet" surveillance that should be forbidden by the Fourth Amendment. (15)

   Part V then suggests a simple step that can alleviate this constitutional difficulty: excluding registration information--the location data that phones generate automatically--from the scope of the third-party doctrine's reach. This exclusion is consistent with the doctrine's foundational cases and with a reasonable cellphone user's understanding of how a phone generates location information. Further, the exclusion is straightforward to apply and would not unduly hamper criminal investigations. Part VI concludes.

2. CELLPHONE LOCATION INFORMATION: WHERE IT COMES FROM AND HOW MUCH THERE IS

   Cellphones generate location information as a natural consequence of their operation. (16) To work, a phone must communicate with nearby cellular towers-also called base stations (17)--to determine which one produces the strongest signal in that spot. (18) Usually, that tower is the one closest to the phone. (19) Increasing demand on network resources has led to the rapid proliferation of towers and base stations, which then provide ever more specific data points for location information. (20) Indeed, inside a dense network of towers, the particular sector a single tower serves can be small enough to pinpoint a phone using that tower to within forty feet. (21)

   Location information is not limited simply to identifying the tower nearest a phone when a call is made. Although only the tower with the strongest signal carries data to the phone, other towers within the phone's range can detect its signals. (22) By comparing the timing and angle of a phone's incoming signals among several towers, the phone's location can be determined with precision--often to within fifty meters. (23) A phone with internal GPS technology can often be located even more precisely. (24) Further, cellphones automatically check in with nearby towers when they are turned on but not in use, generating what is known as registration information. (25) These automatic check-ins happen approximately every seven seconds. (26)

   Service providers can and do collect and store user location information. (27) Analyzing the data shows the provider where the demand for its services is highest and thus helps direct its growth and development. (28) And while most service providers disclose in their privacy policies that they collect and store location information, the disclosures are often vague about how long the providers retain it. (29)

   In sum, a switched-on phone generates location information whether it is in use or not. That information is increasingly precise, and it is collected by service providers and stored for an unspecified amount of time.

3. STATUTORY AND CONSTITUTIONAL PROTECTION OF CELLPHONE LOCATION INFORMATION

   1. Statutory Protection

      The privacy of cellphone location information is protected by several federal laws acting in concert. The most important is the Electronic Communications Privacy Act (30) ("ECPA"), which establishes a tiered framework of protection for different types of electronic communications. (31) To monitor or access a covered electronic communication, law enforcement must seek judicial approval. The burden of suspicion law enforcement must demonstrate before a judge will approve the requested monitoring or access depends on the tier in which that type of communication falls. (32) Three of ECPA's tiers--those concerning tracking devices, stored communications, and pen registers--cover the electronic communications from cellphones related to their locations. (33)

      The tier covering communications from mobile tracking devices carries the highest burden of these three, requiring a warrant supported by probable cause. (34) The relevant statute, 18 U.S.C. [section] 3117, defines a tracking device as any "electronic or mechanical device which permits the tracking of the movement of a person or object." (35) Courts have consistently held that a cellphone meets this definition when a law enforcement agency requests prospective information about a phone's location--that is, when it seeks permission to locate the phone in real time. (36) But at the same time, many courts have held that this definition does not extend to historical cellphone location data, which contains records of past movements. (37) Courts thus have interpreted the term "permits" in [section] (37) as being forward-looking.

      Records of a cellphone's past locations instead fall under the second protection tier, which covers stored information about past electronic communications. (38) This portion of ECPA is called the Stored Communications Act ("SCA"). Under the SCA, before a stored "record or other information pertaining to" a cellphone user's communications may be disclosed, law enforcement must demonstrate "specific and articulable facts" showing "reasonable grounds to believe that ... the records or other information sought are relevant and material to an ongoing criminal investigation." (39) This standard is "a lesser one" than probable cause. (40) Under it, law enforcement has successfully requested information stretching back several months from the request date. (41)

      ECPA's lowest tier of protection applies to the installation of pen registers and trap-and-trace devices. These devices are used to capture the numbers dialed from a phone and the numbers of any incoming callers. (42) Upon certification by a law enforcement officer that pen register or trap-and-trace information is "relevant" to an ongoing criminal investigation, a magistrate must order a provider to disclose it. (43)

      At first blush, cellphone location information does not seem to overlap with the type of information collected by pen registers and trap-and-trace devices. But amendments to the original ECPA added the term "signaling information" to the definitions of both pen registers and of trap-and-trace devices. (44) Some law enforcement agencies have therefore argued that registration information--the information automatically sent to nearby towers every few seconds when the phone is on--is "signaling information" within the meaning of ECPA. (45)

      But this interpretation is strained given the statute's focus on capturing information produced by actively using a phone. (46) And shoehorning registration information into the pen register definition also does violence to ECPA's carefully reticulated system of protection. As noted in Part II, registration information creates more location information than voluntary use because the phone registers with nearby towers every few seconds whether it is in use or not. (47) But if registration information is considered "signaling information," ECPA would, paradoxically, give more protection to less...