Privacy in the cloud: the mosaic theory and the Stored Communications Act.

• Author: Schlabach, Gabriel R.

In United States v. Jones, the Supreme Court held that the Fourth Amendment prohibits the government from installing GPS devices on suspects' cars without a warrant. Although the majority limited its holding to the physical installation of such devices, five concurring Justices (including Justice Sotomayor, who joined the majority opinion) indicated their desire for broader privacy protections by endorsing the adoption of the ",mosaic theory. " Under this theory, certain types of long-term (or otherwise expansive) surveillance violate a suspect's reasonable expectation of privacy, even when each individual act of surveillance would otherwise pass Fourth Amendment muster, because the government can analyze the information in the aggregate to infer private details about the suspect that no individual member of the public could reasonably discover by observing her for a short time.

While Jones was limited to GPS tracking, mosaic theory concerns logically extend to a much wider range of new technologies. In recent years, telephone and Internet service providers have amassed extensive (and growing) amounts of data about their customers--more than enough to construct revealing mosaics of these individuals' lives. But under the Stored Communications Act, a component of the Electronic Communications Privacy Act of 1986, the government may order such companies to turn over customers' records using only a court order or an administrative subpoena--less than the warrant and probable cause requirements of a typical Fourth Amendment search.

Responding to such increasing threats to privacy, this Note proposes an amendment to the Stored Communications Act that would incorporate the mosaic theory into the statute. Under this proposal, government requests for the contents of communications as well as requests for expansive amounts of "noncontent" metadata would require a warrant and probable cause. Targeted and limited requests for noncontent data, however, would remain governed by the Stored Communications Act's current requirements. These changes would address the concerns articulated by the mosaic theory while improving the statute's ability to address future technological change.

INTRODUCTION I. DEFINING THE MOSAIC THEORY: MAYNARD AND JONES A. United States v. Maynard; Introducing the Mosaic Theory B. United States v. Jones and Riley v. California; Complicating the Mosaic Theory II. ONLINE PRIVACY AND CURRENT LAW A. Telephone and Internet Data Collection B. The Insufficient Protection of Online Privacy Under Current Law 1. The third-party doctrine 2. The Electronic Communications Privacy Act III. REFORMING THE STORED COMMUNICATIONS ACT A. The Need for a Statutory Solution B. The Proposed Amendment to the Stored Communications Act 1. Incorporating a three-tiered mosaic framework 2. A suppression remedy 3. Defining "network service" C. Alternative Proposals for Amending the Stored Communications Act CONCLUSION APPENDIX INTRODUCTION

In United States v. Jones, (1) the Supreme Court relied on "18th-century tort law" (2) to dodge a decidedly twenty-first-century issue: Should Fourth Amendment doctrine account for the government's increasing technological ability to easily and inexpensively monitor suspects? And if so, how? The D.C. Circuit, in the case below, addressed the issue by introducing (or, more accurately, repurposing (3)) a novel approach that has been termed the "mosaic theory." (4) Under the mosaic theory, certain forms of long-term surveillance violate a suspect's reasonable expectation of privacy, even when each individual act of surveillance would itself pass Fourth Amendment muster, because the government can use the aggregate surveillance data to infer private details about the suspect that no individual member of the public could reasonably learn by observing the suspect for a short time. Applying the mosaic theory, the D.C. Circuit held that the government's month-long, warrantless GPS surveillance of the defendant, Antoine Jones, violated his Fourth Amendment right to be free from unreasonable searches. (5) On appeal, the Supreme Court agreed that the police officers' behavior was unconstitutional but reached its holding on different grounds. Instead of addressing the month-long monitoring of Jones's movements, the majority focused on the police officers' warrantless installation of a physical GPS device on Jones's car, determining that even this de minimis physical trespass violated the Fourth Amendment. (6) While the Court's holding was more limited than privacy rights supporters might have preferred, (7) five Justices seemed willing to adopt some version of the mosaic theory, if not in Jones then in a future case not involving physical trespass. (8)

Although Jones was limited to GPS tracking, mosaic theory concerns logically extend to a wide range of new technologies. GPS technology endangers privacy by allowing the government, at very little cost, to monitor the physical movements of a suspect and infer private details about the suspect's life unrelated to the investigation. (9) Other types of technological surveillance pose similar, if not greater, privacy risks. Edward Snowden's disclosures have demonstrated the breadth of the National Security Agency's electronic surveillance efforts, including certain forms of domestic surveillance. (10) On a smaller scale, similar techniques are now used in domestic criminal investigations. Even after Riley v. California, (11) which prohibited warrantless searches of mobile phones, local, state, and federal law enforcement officers retain the ability to monitor suspects' activities by requesting personal information from telephone and Internet service providers. (12) The largest of these companies, which include traditional telecoms such as Verizon and Internet service providers such as Google, often have access to users' Internet histories, search queries, e-mail correspondence, physical location information, and much more. And under the Stored Communications Act, (13) the government may require companies to disclose much of this information with only a court order or an administrative subpoena. (14) As a result of this compelled third-party assistance, the government can create a "mosaic" of users' online (and even offline) activities without being bound by the Fourth Amendment's typical warrant and probable cause requirements.

This Note argues that the Stored Communications Act's protections are inadequate in light of the conceptual insights of the mosaic theory and the massive technological changes that have occurred since the statute's passage in 1986. Part I explores the mosaic theory in more depth by analyzing the mosaic theory opinions in Jones and United States v. Maynard (15) (the case below). Part II documents modern companies' data collection capabilities to demonstrate why the current version of the Stored Communications Act fails to adequately protect Internet users' privacy. Part III proposes an amendment to the Stored Communications Act that incorporates a version of the mosaic theory.

1. DEFINING THE MOSAIC THEORY: MA WARD AND JONES

   Although the mosaic theory is conceptually broad enough to inform privacy policy in a wide range of technological contexts, the theory traces its origins to the government's use of a GPS tracking device in a fairly straightforward police investigation of a cocaine distribution conspiracy. In order to clarify the reasoning behind the theory before arguing for its integration into the Stored Communications Act, this Part summarizes the facts of the case, the D.C. Circuit's initial conception of the mosaic theory in Maynard, and the concurring Supreme Court Justices' slightly different definitions of the theory in Jones.

   1. United States v. Maynard/ Introducing the Mosaic Theory

      In 2004, a joint FBI and Metropolitan Police Department task force began investigating Antoine Jones, a Washington, D.C., nightclub owner suspected of--and later charged with--conspiring to distribute drugs. (16) In 2005, the task force applied for a warrant to place a GPS device on Jones's car. (17) Despite the officers' good faith efforts in seeking the warrant, they failed to follow the warrant's requirements. (18) The warrant granted the officers ten days to plant the device, but they did not do so until the eleventh. (19) The warrant also required them to install the device while Jones's car was parked in the District of Columbia, but they did so in Maryland. (20)

      Over the next twenty-eight days, the device tracked the movements of Jones's car. (21) It relayed the car's location to the officers, who collected over 2000 pages of location data. (22) The officers relied on these data (combined with other evidence) to connect Jones to the conspiracy's stash house, which contained "$850,000 in cash, 97 kilograms of cocaine, and 1 kilogram of cocaine base." (23) At trial, Jones unsuccessfully attempted to suppress the GPS data, arguing that the officers violated the warrant requirements and lacked probable cause to suspect that his vehicle was connected to criminal activity. (24)

      Relying on strikingly novel reasoning, the D.C. Circuit reversed, holding that "the extended recordation of a person's movements" without a proper warrant is outside the realm of reasonable searches. (25) To reach this conclusion, the appellate court borrowed the concept of the "mosaic theory" from national security cases. (26) In Freedom of Information Act cases, for example, intelligence agencies invoke the theory to defend against requests for disclosure, arguing that official disclosure of "superficially innocuous information" might allow "[f]oreign intelligence services ... to ... deduc[e] the identities of intelligence sources" merely from "knowing what is being studied and researched by [American] agencies." (27) The fear is that "[thousands of bits and pieces of seemingly innocuous information can be analyzed and fitted into place to reveal with...