State High Courts Realize It's Not 1986 Anymore, Broaden Privacy Protections

This was posted to privacysos.org.

Technology in the digital age has changed the way the government conducts surveillance against targets, and the law must change accordingly. So ruled two separate state supreme courts in decisions that take on the so-called 'third-party doctrine,' an outdated legal precedent that serves as the foundation for the federal government's defense of NSA and FBI bulk records surveillance programs.

In two state supreme court rulings published Tuesday, jurists in Massachusetts and Hawaii created new space for the expansion of privacy rights under their state constitutions. The Hawaiian justices found that, as technology changes, the law must change with it—and state courts have a role to play in pushing legislatures and federal courts to adapt more quickly. Massachusetts' high court did just that, by limiting the government's authority to obtain without warrants information held about us by third parties. Specifically, Massachusetts justices ruled 5-2 that police must obtain a probable cause warrant in order to obtain two weeks or more of cell site location information from our telecommunications companies.

In Hawaii, the Supreme Court held that

The rule that an individual has no legitimate expectation of privacy in any information shared with a third party cannot be justified in all situations….Rapid changes in technology have altered our lifestyles, creating a dissonance between a mechanical application of the expectation of privacy test and its core meaning. The last fifty years have witnessed a significant period of change in the law pertaining to criminal procedure. United States Supreme Court and Hawaii Supreme Court decisions have diverged in the area of constitutional protections against unreasonable searches and seizures. But as noted, the U.S. Supreme Court itself recognized, "state courts are absolutely free to interpret state constitutional provisions to accord greater protection to individual rights than do similar provisions of the United States Constitution….

The modification or reformulation of a privacy test is possible, thus, at the state level. It would seem beyond purview that a reasonable person would not expect that disclosure to third parties would, ipso facto, permit government scrutiny or intrusion into otherwise protected privacy zones without at least some safeguards inhering in the checks among the separate branches of government. An expectation of privacy, even though extended to matters exposed to third persons, would be viewed as reasonable by society, where such exposure is inevitable and inescapable in the conduct of the necessary affairs of life. The alternative is to countenance the inexorable diminishment of personal privacy and the substantial risk of privacy zones disappearing altogether.

Here in the Commonwealth, justices did exactly what the Hawaiian Supreme Court describes state courts must do: limit government access to records held by third parties, broadening our privacy rights concerning technologies that are "inescapable in the conduct of the necessary affairs of life."

Cell site location data: get a warrant

The Massachusetts Supreme Judicial Court agreed with the ACLU of Massachusetts when we argued that our client, Shabazz Augustine, had a right to privacy in the cell site location information his phone company held about him. Citing the outdated but still widely applied third-party doctrine, the government argued that Augustine didn't have a privacy interest in information he turned over to his cell phone company, including the cell site location information showing where he was when he made and received phone calls. In the Commonwealth's view, Augustine had no standing to defend information that he did not possess, and which he supposedly willingly turned over to his cell phone company.

But in a five to two ruling, Massachusetts' highest court disagreed, broadening constitutional privacy protections for every person in the state. The two Supreme Court cases that comprise the bedrock of legal precedent for the third-party doctrine—Smith v Maryland and United States v Miller—do not apply to cell site location data, the court found:

We agree with the defendant…that the nature of cellular telephone technology and CSLI and the character of cellular telephone use in our current society render the third-party doctrine of Miller and Smith inapposite; the digital age has altered dramatically the societal landscape from the 1970s, when Miller and Smith were written.

Cell phones are not land lines, the high court found, and not using them is not a viable option in modern society:

Cellular telephones are increasingly viewed as necessary to social interactions as well as the conduct of business. More fundamentally, and of obvious importance to the present case, cellular telephones physically accompany their users everywhere—almost permanent attachments to their bodies…As anyone knows who has walked down the street or taken public transportation in a city like Boston, many if not most of one's fellow pedestrians or travelers are constantly using their cellular telephones.

Citing Jones and Rousseau—a Massachusetts SJC ruling on GPS tracking finding that "the government's contemporaneous electronic monitoring of one's coming and goings in public places invades one's reasonable expectation of privacy"—the five justices agreed that "[cell site location information] implicates the same nature of privacy concerns as a GPS tracking device."

But they go even further than Rousseau and Jones. The justices conclude that "because of the nature of cellular telephone use and technology, there is a strong argument that CSLI raises even greater privacy concerns than a GPS tracking device. In contrast to such a device attached to a vehicle [], because a cellular telephone is carried on the person of its user, it tracks the user's location far beyond the limitations of where a car can travel…As a result, CSLI clearly has the potential to track a cellular telephone user's location in constitutionally protected areas" such as the home.

The Massachusetts high court found that Smith does not apply to cell site location information, carving out a location-tracking sized hole in the third-party doctrine. According to the court, Smith doesn't apply to CSLI because unlike the numbers you dial on a phone, you cannot control whether or not your phone sends cell site location information to your cell phone provider. And while you purchased your phone in part to make phone calls on it, you certainly didn't buy a phone so that your cell phone company and the police could track your whereabouts. Here's how the court put it:

CSLI is purely a function and product of cellular telephone technology, created by the provider's system network at the time that a cellular telephone call connects to a cell site. And at least with respect to calls received but not answered, this information would be unknown and unknowable to the telephone user in advance—or probably at any time until he or she receives a copy of the CSLI record itself. Moreover, it is of course the case that CSLI has no connection at all to the reason people use cellular telephones.

And while land lines can only tell the phone company (and therefore the government) very limited information about your whereabouts, such as when you were at your home or office, a cell phone travels with you everywhere you go, revealing much more detailed information about your private affairs.

Finally, in terms of the privacy interest at stake here—the individual's justifiable interest in not having "his comings and goings…continuously and contemporaneously monitored" by the government, the enormous difference between the cellular telephone in this case and the "land line" telephone in Smith seems very relevant. In terms of location, a call log relating to a land line may indicate whether the subscriber is at home, but no more. But for a cellular telephone user carrying a telephone handset (as the defendant was), even CSLI limited to the cell site locations of telephone calls made and received may yield a treasure trove of very detailed and extensive information about the individual's "comings and goings" in both public and privacy places; in this case, as mentioned, the defendant's CSLI obtained by the Commonwealth covered at least sixty-four pages.

The justices did not set a ceiling for constitutional protections against warrantless location tracking, but they did set a floor. As a result of Tuesday's decision, if a Massachusetts law enforcement agency wants to obtain two weeks or more of cell site location information on a surveillance target, they must first get a warrant.

Time for the legislature to act

Tuesday's ruling in Massachusetts immediately changes the law with respect to location tracking, but it only explicitly deals with cell phones, and it doesn't specify whether or not police need a warrant to track someone's cell location for 13 days instead of 14. That's still up to the legislature. The Electronic Privacy Act, currently before the Joint Judiciary Committee, would require a warrant for all cell phone location tracking—no matter how many days police want to track you, or using what kind of technology.

While the ruling doesn't explicitly mention license plate tracking technology, there's good reason to believe the court's opinion is applicable to the now widespread harvesting and regional and national pooling of license plate reader data. After all, plate readers collect and collate our movements at least as comprehensively as cell site information derived from calls made and received. If police need a warrant to obtain two weeks of CSLI, they should also be required to get a warrant to collect or demand two weeks of license plate reader data.

Indeed, the court found that GPS vehicle location tracking and historical CSLI "are linked at a fundamental level: they both implicate the same constitutionally protected interest—a person's reasonable expectation of privacy—in the same manner—by tracking the person's movements. Given this intrinsic link, it is likely that the duration of the period for which historical CSLI is sought will be a relevant consideration in the reasonable expectation of privacy calculus—that there is some period of time for which the Commonwealth may obtain a person's historical CSLI" with only a relevant and material (d) order, and not a warrant.

"But there is no need to consider at this juncture what the boundaries of such a time period might be in this case because…the two weeks covered by the [court order] at issue exceeds it: even though restricted to telephone calls sent and received (answered or unanswered), the tracking of the defendant's movements in the urban Boston area for two weeks was more than sufficient to intrude upon the defendant's expectation of privacy safeguarded by [article 14 of the Massachusetts state constitution]."

Technology changes the power balance between law enforcement and the public. This week the high courts of both Massachusetts and Hawaii signaled that they have a robust role to play in making sure that our privacy rights don't get left in the dust. The Massachusetts Supreme Judicial Court has sketched out a fine roadmap. Now it's the legislature's turn to color in the details.

This was posted to privacysos.org.