Real-time and historic location surveillance after United States v. Jones: an administrable, mildly mosaic approach.

• Author: Henderson, Stephen E.
• Position: ABA Standards on Law Enforcement Access to Third Party Records - Symposium on Cybercrime

TABLE OF CONTENTS I. CELL TOWER DUMPS, LAW ENFORCEMENT, AND PRIVACY A. The High Country Bandits B. The Relevance of United States v. Jones II. LOCATION RECORDS UNDER THE ABA LEATPR STANDARDS A. Overview of the Standards. B. Application to Location Information C. Probable Cause of What? D. Administrability of a "Mosaic" Approach E. Application to the High Country Bandits. F. De-Identified Records and the High Country Bandits III. REAL-TIME LOCATION SURVEILLANCE IV. A FEW THOUGHTS ON PROCESS V. CONCLUSION I. CELL TOWER DUMPS, LAW ENFORCEMENT, AND PRIVACY

The aim of this Article is to develop an administrable set of regulations for both historic and real-time law enforcement location surveillance. In order to do that, it is critical to understand how and why law enforcement might access such information. I therefore begin by describing a clever investigation and the relevance of United States v. Jones, and then turn to developing regulations.

1. THE HIGH COUNTRY BANDITS

   Ronald Capito and Joel Glore, dubbed the "High Country Bandits," robbed sixteen banks in four states. (1) Their downfall was that they chose to carry and use a tracking device during and near those robberies. Although that sounds especially dumb, and it admittedly is not all that smart, most of us carry such a device, and many of us carry one at almost all times: a cellular phone. From among the victim banks, police selected several of the more remote locations and gathered the phone records pertaining to the cell towers nearest those banks at the relevant times. Using a computer, they searched through the records, which pertained to 150,000 subscribers, and found two phones were used at every location. One belonged to Capito, and one belonged to Glore. (2)

   This was not the first time that accessing all records pertaining to certain cell towers--known as "tower dumps"--has solved a string of bank robberies, (3) and it is plainly good police work. Indeed, a similar basic modus operandi appears to have been used in the investigation that resulted in the resignation of CIA Director David Petraeus. (4) Such records access is thus good police work, but it is also invasive of privacy. In the Petraeus investigation, which reads like a soap opera, it is very easy to see the personal ramifications. (5) In the investigation of the High Country Bandits, the phone records of 150,000 persons were perused. Moreover, a cell phone is in regular communication with the nearest cell tower anytime it is "active," meaning anytime it is turned on. (6) Were this not the case, it would be impossible to receive a telephone call. And while providers today typically only store location information when a call is in progress, they are likely to begin more broadly storing the location of a phone anytime it is active. (7) Thus, cellular phone providers will potentially possess a virtually complete record of a customer's location at all times, and that vast record can be mined by police. (8)

   The reasonable question, therefore, is what restraints or regulations the law should place upon such access. In the investigation of the High Country Bandits, a court order was used to obtain the cellular records, and police selected the most rural bank locations "in order to minimize the amount of extraneous telephone data that would likely be obtained." (9) Once police searched those records and located two phone numbers of interest, they proceeded to obtain further record information.

   For the first telephone number, police could have subpoenaed the subscriber's identifying information from the telephone provider. (10) But because they also wanted to acquire further transactional records pertaining to the phone, they probably used a single "specific and articulable facts" court order. (11) They learned that this phone was registered to Capito. (12) The second number was assigned to a prepaid phone, meaning the subscriber was not required to provide identifying information or, at least, accurate identifying information. Fortunately for police, Glore was accommodating and upon purchase had provided his name and date of birth. (13) The acquired call detail records for both phones--noting when calls were placed or received and at what geographic location--corroborated the police's suspicion. (14)

   Police conducted physical searches and further records searches. (15) As for records, police used Google and Internet databases of property records, and obtained records held by the commercial data aggregator and broker ChoicePoint, (16) a motor vehicle department, courts, casinos, hotels, and a gas station. (17) From this single investigation it is evident that records access is vitally important to effective law enforcement, and extremely commonplace. Records access can solve a murder, as when police caught a serial killer by tracing a map he generated online. (18) And records access can defuse an emergency, as when police tracked the location of a cell phone from which a sister had received a chilling message: "The girl with this phone is dead...." (19)

   Once again, the reasonable question is therefore what restraints or regulations should be placed upon law enforcement records access. Perhaps some people believe that law enforcement access should not be regulated: we should entirely trust our privacy to the integrity of police officers. Perhaps some people believe that law enforcement access should be highly regulated: we should place a neutral and detached magistrate between citizens and the officer engaged in the "competitive enterprise of ferreting out crime," (20) and that magistrate should make a demanding substantive inquiry before permitting access. Perhaps some people believe that law enforcement access should be constitutionally regulated, meaning the source of this regulation should be the federal and/or state constitution. Perhaps some people believe the source should be statutory. When one considers the diversity of records information, reasonable people, I submit, believe there should be some constitutional regulation, some statutory regulation, and some things left to officer integrity. The details of specific regulations applying to particular types of information will be contested and difficult. But those details are worth working out because the binary alternatives--either zero regulation or "total" regulation--are completely unacceptable. We require legislative differential regulation, by which I mean a hierarchy of regulation proportional to privacy, yet responsive to law enforcement needs, subject to a constitutional backstop.

2. THE RELEVANCE OF UNITED STATES V. JONES

   This need for regulation is why United States v. Jones (21) was a unanimous decision as to the prevailing party. The government took an egregious position, namely that law enforcement can surreptitiously electronically track the movements of any American over the course of an entire month without any Fourth Amendment restraint. (22) In this instance the tracking was via a GPS device attached to the defendant's vehicle, but as I have described, that same information could be obtained from third-party records. And it was not difficult for the Justices to recognize that such tracking could be used against them. At oral argument, Justice Roberts asked just that. (23) Now that technology has removed the formerly significant resource restraints on tracking location, it is possible to track all of us. But it was more than self-interest that generated a nine-to-zero loss for the government. It was the common sense that in a free and democratic society, and one in which at least some law enforcement abuse has been known to occur, (24) law enforcement should not be permitted to engage in such long-term tracking without restraint.

   What restraint did the Justices select, at least as to the GPS tracking before the Court? Not a single Justice answered this question. Justice Scalia, writing for a majority of five, focused on the installation of the GPS device and held that a trespass to a constitutionally protected person, house, paper, or effect in order to obtain information constitutes a Fourth Amendment search, thus resurrecting the pre-Katz trespass-or property-based Fourth Amendment. (25) But the Court did not decide whether a warrant or some other judicial preclearance was necessary, or what quantum of suspicion was required for that search to be reasonable. (26) Justice Alito, writing for a concurring four, instead held that the long-term electronic monitoring of location constitutes a search because it invades a reasonable expectation of privacy. (27) And Justice Sotomayor, who joined the majority, also wrote a separate concurrence agreeing with Alito. (28) So we have two conceptions of Fourth Amendment search, both of which were satisfied, but no answer as to what law enforcement must know or do before conducting that search. (29)

   This lack of guidance is not surprising, not only because the government had not argued the issue--thinking nothing necessary to justify its actions--but also because that guidance is difficult. Two terms before, the Court punted when it came to the Fourth Amendment regulation of another type of record--text messages in the hands of a service provider. (30) And in Jones, Alito stressed what Professor Daniel Solove and others have argued, which is that it would be ideal for legislatures to take a first stab at these complicated questions, after which courts can review whether those solutions meet the constitutional floor. (31)

   I can personally attest to the difficulty of articulating guidance. For the past six years, I have served as Reporter for a new set of ABA Criminal Justice Standards, entitled Law Enforcement Access to Third Party Records (LEATPR). The ABA process is appropriately thorough and rigorous, consisting of several stages at which all interested parties have a voice. (32) In February 2012, the ABA House of Delegates approved consensus blackletter standards. (33)

   ...