Privacy in the Cell Phone Age: New Restrictions on Police Activity.

• Author: Ricciuti, Michael D.

"[I]t may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties." (1)

1. INTRODUCTION

   Five decades ago, in Katz v. United States, (2) Justice Harlan expressed his understanding of the scope of Fourth Amendment protection:

   As the Court's opinion states, 'the Fourth Amendment protects people, not places.' The question, however, is what protection it affords to those people. Generally, as here, the answer to that question requires reference to a 'place.' My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable.' Thus a man's home is, for most purposes, a place where he expects privacy, but objects, activities, or statements that he exposes to the 'plain view' of outsiders are not 'protected' because no intention to keep them to himself has been exhibited. On the other hand, conversations in the open would not be protected against being overheard, for the expectation of privacy under the circumstances would be unreasonable. (3) In part based on Katz, the Supreme Court established a body of Fourth Amendment law, including what became known as the "third-party doctrine." The third-party doctrine provides that a citizen is not entitled to Fourth Amendment protection for information or documents he or she entrusts to a third party--say checks negotiated through a bank or a telephone service numbers dialed using a telephone company's services--because there is no legitimate privacy interest in the documents or information that were voluntarily shared with the third party. Applying this doctrine was challenging prior to the advent of technologies that permitted citizens to entrust large swaths of their private information to servers operated by third parties. After the digital revolution, it became more than challenging, as Justice Sotomayor noted in the quote above. (4)

   This Article focuses on this issue and on the developing principles in criminal cases governing search and seizure of digital evidence maintained on or created using cell phones. The Supreme Court has been grappling with the scope of Fourth Amendment protection over such digital evidence in earnest since 2012, and it has rendered three significant, privacy-protective decisions. In them, the Supreme Court has rejected a blanket application of the third-party doctrine, but has not abandoned the concept either.

   The net result is unclear. At its core, the issue in these cases is consent--when do citizens consent to a waiver of their privacy when they use third-party mechanisms to store information or communicate with one another, and how far does such consent extend? Whether and how a citizen's "assumption of the risk" of disclosure plays in this analysis is open to question, and it is unclear how a court should decide whether and to what extent a waiver of privacy rights has been made. One of the new cases permits a potentially powerful argument that police action, as opposed to action by others, is subject to greater restriction than action by private citizens, so that digital privacy is protected from the government's scrutiny but not from the scrutiny of at least some ordinary citizens. But how far that protection extends is also subject to serious question. Moreover, even where the Court does not find a broad waiver of privacy, especially against police surveillance, and requires issuance of search warrants, before such information can be obtained by the police, the reality in the new digital world is that users are increasingly creating and voluntarily sharing data more freely and more broadly that has been the case historically, even extremely private data like DNA profiles. The real questions posed by these cases, then, is not only whether the Court will extend privacy protections despite this sharing and, but also whether it will matter.

2. OVERVIEW

   As is well known today, cell phones are not just telephones. They are not even primarily telephones. They are powerful computers with built-in, automatic, and (often) unnoticed tracking devices. (5) And they are ubiquitous; it is virtually impossible to survive in modern society without one. (6) As a consequence, virtually all citizens carry a computer capable of storing massive amounts of personal data and permitting instantaneous global communication-while simultaneously and incidentally serving as a personal global positioning system (GPS) device. (7)

   Over the past handful of terms, the Supreme Court has wrestled with whether police must obtain search warrants to access information stored on these devices or held by the communication companies that provide them with cellular services. (8) Well-established case law suggested that no search warrant was necessary to seize what was on the phone or stored with the cell phone companies supporting it. (9) Further, at arrest, the law had long permitted the police to seize and search things found on a defendant's person, which would include cell phones. (10) For the same reason that a search of the defendant's wallet upon arrest was permissible, the police argued that so was the search of his or her cell phone. And if information generated using the cell phone was stored with a third party, the third-party doctrine--a concept based on cases decided in the 1970s--held that the evidence was available to government agents armed with no more than a subpoena because the information had already been disclosed to a third party and was therefore was no longer private and protected against disclosure to the police under the Fourth Amendment. (11)

   Applied blindly, then, case law developed for a different era threatened the privacy over everything on a cell phone or communicated using it, regardless of how much personal data, was put at risk of disclosure. In addition, data generated by the cell phone company itself--which is neither created by the user nor accessed by him or her--might also be available to the government just for the asking. Would it matter whether the user were unaware that such information was created in the first place? What if the information captured provided a detailed, historical record of everywhere the user went with the phone? Was that data private at all?

   Three recent decisions addressed these questions, at least in part. First, the GPS case, United States v. Jones, (12) concerned whether the government could attach a GPS device and track a vehicle's movements without a warrant. (13) Second, the cell phone case, Riley v. California, (14) decided in 2013, examined whether the search incident to arrest exception to the warrant requirement allowed the police to search the data maintained in a cell phone seized from a defendant at arrest, including data held by third parties. (15) Third, and most importantly, Carpenter v. United States, (16) decided in mid-2018, analyzed whether the third-party doctrine applied to permit the police to obtain without warrant location information generated automatically by a cell phone service provider, which effectively tracked the location of a cell phone the entire time it was turned on. (17)

   In each of these cases, the Court re-interpreted well-established law to restrict the ability of the police to search electronic information without a warrant, albeit they did so somewhat inconsistently. (18) These decisions were rights-protective, and may well spell the doom of the third-party doctrine, one of the historically powerful arguments relied upon by the government to justify seizure of records held on behalf of individuals by others. But any conclusion that these cases put to rest the risk to privacy in the digital world would be seriously mistaken.

3. THE FOURTH AMENDMENT, PRIVACY AND THE THIRD-PARTY DOCTRINE

   1. Privacy Under the Fourth Amendment

      The Fourth Amendment provides that "[t]he right of the people to be secure in their persons, houses, papers and effects against unreasonable searches and seizures shall not be violated." (19) For generations, the key test for determining what is private and therefore within the scope of the Fourth Amendment was articulated in Katz. (20) Interestingly, the Katz test was not found in the majority opinion in that case, but was set out in Justice Harlan's well-known concurrence. (21) In it, Harlan articulated a two-pronged definition of what is private and therefore within the scope of the protection of the Fourth Amendment, a definition which guided Fourth Amendment jurisprudence ever since: "My understanding of the rule that has emerged from prior decisions is that there is a two-fold requirement, first that a person have exhibited an actual (subjective) expectation of privacy, and, second, that the expectation be one that society is prepared to recognize as reasonable." (22) If both of these requirements are met--that the rights-holder has a subjective expectation of privacy, and that society, objectively, recognizes the expectation as reasonable--the interest is protected under the Fourth Amendment. Embedded in this definition is the concept of waiver--that a claimant to an expectation of privacy and society's assessment of its reasonableness are subject to intentional or unintentional waiver by the rights holder. Justice Harlan made this point in the next line of his concurrence:

      Thus a man's home is, for most purposes, a place where he expects privacy, but objects, activities, or statements that he exposes to the "plain view" of outsiders are not "protected" because no intention to keep the to himself has been exhibited. On the other hand, conversations in the open would not be protected against being overheard, for the expectation of privacy under the circumstances would be unreasonable. (23) Under this definition, then, a person who...