Habeas Data_Privacy vs. The Rise of Surveillance Tech

by Cyrus Farivar

  Amongst Fourth Amendment scholars, there’s something of a split as to whether the Supreme Court’s reliance on the mosaic theory even makes practical sense.

  Orin Kerr, for example, a noted law professor at the University of Southern California, argued in a paper published just weeks after the Jones decision that adopting the mosaic theory “implicates fundamental questions” about the Fourth Amendment. Notably, he argued, the Supreme Court casts aside the traditional sequential analysis as to whether particular actions constitute a search. Traditionally, a search has occurred when law enforcement is able to take something that was hidden and make it visible—whether that object or information is contained within a home, a bag, a car, or a computer.

  By contrast, the mosaic theory is predicated on the notion that a series of discrete “non-searches” (observing Jones’ location in public, for example), over a great enough (and unspecified) period of time, becomes a Fourth Amendment search.

  “In the past, however, this was considered good police work rather than cause for alarm,” he wrote. “The repeated use of nonsearch techniques has been considered an essential way to create probable cause that justifies searches rather than an unlawful search itself.”

  Worse still, Kerr concluded, it’s impossible for law enforcement, legislators, and judges alike to know precisely where the mosaic line has been crossed. What marks the magical moment when a Fourth Amendment search is triggered? Does it apply equally to all technologies?

  Kerr also explained how under the sequential approach courts typically have two options when it comes to adjudicating police practice. Judges can say that a particular conduct is never a Fourth Amendment search but that legislative bodies can erect new laws regulating the state’s behavior. The California Electronic Communication Privacy Act, the California state law that generally requires the use of a warrant to obtain various types of electronic information, is one example of this. It sets a higher bar over the existing federal law, which doesn’t consider the acquisition of certain types of non-content data to be a search.

  Alternatively, they can say that some conduct is always a Fourth Amendment search (for example, using an infrared imaging device without a warrant, like in Kyllo).

  “The mosaic theory offers a vague middle ground as a third option,” Kerr concluded. “The theory allows courts to say that techniques are sometimes a search. They are not searches when grouped in some ways (when no mosaic exists) but become searches when grouped in other ways (when the mosaic line is crossed).”

  In fact, in the wake of the Jones ruling, hundreds of law professors and legal experts who convene annually at the Privacy Law Scholars Conference (held every June) invited attendees to a casual competition to see who could come up with a brief (under 1,000 words) workable rule under Jones.

  One law professor, Christopher Slobogin, of Vanderbilt University, in response to Kerr, did so decisively. His proposal was eventually enhanced and turned into yet another legal journal article, where he attempted to actually codify what a mosaic theory–based statute might look like. In essence, it prescribes firm time limits as to what kind of data can be collected, for how long, and what legal authority is required. It also, unusually, upends the legalistic definition of a search, and attempts to put it in closer alignment with what most non-lawyer laypersons might understand.

  Slobogin presents clear and easy-to-understand rules like this:

  (a) A targeted public search that lasts longer than 48 hours in aggregate requires probable cause, and a warrant unless exigent circumstances exist.

  (b) A targeted public search that lasts longer than 20 minutes in aggregate but no longer than 48 hours in aggregate requires reasonable suspicion, and a court order unless exigent circumstances exist.

  (c) A targeted public search that does not last longer than 20 minutes in aggregate may occur at a law enforcement officer’s discretion whenever the officer believes in good faith that the search can accomplish a legitimate law enforcement objective.

  * * *

  While Kerr argued that the validation of the mosaic theory in light of Jones is unworkable, and Slobogin (among other law professors) have attempted to articulate a clear set of laws that might address a post-Jones landscape, one of the most creative and persuasive ways to understand surveillance is in economic terms. In either case, for now this debate remains largely academic as neither Congress nor the Supreme Court seem interested in providing a clear answer.

  In another 2016 legal academic paper by Kevin Bankston (a former ACLU lawyer now with the New America Foundation) and Ashkan Soltani (not a lawyer, but a prominent independent technologist and privacy researcher), yet another way to understand what kinds of newer surveillance tools should be questioned relative to older ones was proposed. They put forth a simple rule: “If the new tracking technique is an order of magnitude less expensive than the previous technique, the technique violates expectations of privacy and runs afoul of the Fourth Amendment.”

  Using essentially back-of-the-envelope calculations, Bankston and Soltani conclude that a five-person FBI team conducting in-person surveillance of a target on foot costs roughly $250 per hour. When a single agent moves her surveillance to a car, that cost drops to about $105 per hour. A squad of five cars goes up to $275 per hour, while putting in a short-range Knotts-style beeper costs just over $100 per hour. The modern equivalent, the cell-site simulator, costs roughly the same.

  However, when it comes to GPS tracking, a single-day use costs about $10 per hour, but when spread out over 28 days, the cost plummets further, to about $0.36 per hour. Using a d-order and getting cell-site location information—the very data at issue in Carpenter v. United States—not quite as precise as GPS, but still very usable, the cost for 30 days of surveillance crashes even further, from $4 to as low as $0.04 per hour, depending on what the carrier charges.

  Bankston and Soltani concluded by noting the fact that in his law school talk, the FBI’s Weissmann said that the agency had to shut off 3,000 GPS trackers in the wake of the Jones decision. This suggests that as of 2012, the FBI had the capacity to track at least 3,000 people simultaneously.

  “Without that technology, it would require 15,000 agents to covertly follow the same number of targets (assuming five agents for each target),” they wrote.

  Therefore, even if the FBI were to instruct all of its 13,785 special agents to ignore all other duties and remain active for every hour of every day (an assignment that is humanly impossible), it would still be 1,215 agents short of being able to follow that many suspects. These figures dramatically illustrate how mass surveillance that was impossible prior to the introduction of new technologies like GPS is now firmly within the government’s grasp. When such surveillance would have required ludicrous expenditures of time and treasure, there was no need for the Fourth Amendment to protect against it. However, now that the structural constraints against that surveillance have disappeared and the absolutely impossible has become easily possible, Fourth Amendment protection is desperately necessary.

  * * *

  In the Jones decision, Justice Scalia cited a 1986 Supreme Court case known as California v. Ciraolo, as one of the cases that affirmed the “reasonable expectation of privacy.” Ciraolo asked the question as to whether a naked-eye observation of backyard marijuana plants constituted an unconstitutional search. In a 5–4 decision, the court ruled that it did not. In 1989, in a similar case, Florida v. Riley, that limit was lowered further to naked-eye observations at 400 feet in yet another 5–4 decision.

  In that case, Justice Sandra Day O’Connor described in a dissenting opinion what she foresaw coming soon: “a helicopter capable of hovering just above an enclosed courtyard or patio without generating any noise, wind, or dust at all.” That “miraculous tool” now exists. We call it a drone. Indeed, the low cost of government surveillance tools is the driving factor of local law enforcement’s recent expansion of drones.

  As of April 2017, at least 347 local law enforcement, fir
e, and first-responder agencies have acquired drones. By comparison, as of July 2009, only roughly one in five large law enforcement entities (defined as having 100 or more sworn officers) had conventional aircraft, or 201 air units. A September 2016 study from the National Institutes of Justice (a division of the DOJ) noted that helicopters typically cost around $250 per hour to operate, and found that cost was the largest factor as to why more police departments don’t have air units.

  Case in point: in August 2017, Spring Hill, Tennessee, a town with under 35,000 people, acquired a drone when a helicopter would have been otherwise prohibitively expensive. As of 2017, a fully equipped police drone costs just several thousand dollars each to acquire, and has a pretty low operational cost of around $28 per hour (the median police officer’s wage), making it proximate to the Bankston and Soltani order of magnitude rule.

  The Scalia wing of the 2012 Jones court predicated their analysis on what’s known as a property-based analysis. For them, the case was really about the specific fact that the GPS tracker was placed on Jones’ Jeep Grand Cherokee. For those justices, had the police used a different means to record his detailed movements that didn’t involve touching his car at all, it would be a different case.

  (This is one of the Alito wing’s criticisms: “The Court’s reliance on the law of trespass will present particularly vexing problems in cases involving surveillance that is carried out by making electronic, as opposed to physical, contact with the item to be tracked.”)

  There are other ways to conceptualize what the Fourth Amendment protects against, and when something is considered to be a search. There’s the “reasonable expectation of privacy” standard, which flows from Katz. (But for Scalia and other similarly minded conservatives, this test makes no sense either: How can justices or society fully understand what, in fact, is or should be considered reasonable? In his view, the reasonable expectation proxy was too “circular.”)

  Within the scholarly legal landscape, there’s also another notion that privacy is increasingly becoming unmoored in the twenty-first century. Modern technology makes many aspects of privacy—at least, as it would have been understood in the eighteenth or nineteenth centuries—nearly obsolete. After all, nearly all of us routinely share information about ourselves with each other online, ranging from the mundane (Instagram photos of yesterday’s sushi lunch) to the life-altering (baby pictures for days). The fact that the unsolicited publication of someone’s private documents and information online (doxing) has become a twenty-first-century weapon is also illustrative of this fact.

  Given new communications technologies, perhaps it’s better to understand the Fourth Amendment in terms of power, and more specifically, limiting what the government is able to do. After all, it is the government, and not Google, that has the monopoly on violence and incarceration.

  Read as a whole, the Bill of Rights clearly articulates limits on the government’s own power. The First Amendment’s first five words are “Congress shall make no law.” The final words of the Second Amendment are “shall not be infringed.” The Third Amendment: “No soldier shall, in time of peace.” And the Fourth Amendment describes limits to how “searches and seizures” should be performed: “but upon probable cause, supported by oath or affirmation.” In other words, the law is meant to check the power of the state.

  In short, this analysis argues, each amendment should be read in the context of limiting the government’s power against the individual. One of the most prominent proponents of this theory is Paul Ohm, an affable forty-five-year-old tech-minded laid-back California-born lawyer, who is now a law professor at Georgetown University. He’s a rare legal mind that knows how to write perl and python code, and continues to do so regularly.

  Ohm came to legal scholarship in something of a roundabout way. He did his undergraduate work at Yale University, earning dual degrees in computer science and electrical engineering, before going on to be a programmer and network administrator at the RAND Corporation for several years. Then, he decided to go to law school, and was accepted at nearby UCLA.

  Upon graduating from law school in 1999, Ohm had two clerkships with two different federal judges in California, and finally, by 2001, he served as a DOJ trial attorney, specializing in computer crime and intellectual property. He then became a professor at the University of Colorado for nearly a decade before being hired at Georgetown in 2015.

  “What the Framers wanted was distance between you and your government,” he said in a May 2017 interview in his office, replete with law books and computer books alike. “They didn’t want general warrants and writs of assistance.”

  Or, put another way, he argued that for centuries, “it was a quirk of physics that this lined up with privacy pretty well.”

  In the eighteenth century, trespass, privacy, and imposing restraints on the government’s power were more or less coterminous. To execute a search upon someone’s home required physical force, trespassing into someone’s home, and projecting the government’s ability to manifest its will upon a citizen. Even by the mid-nineteenth century and well into the twentieth century, obtaining vast amounts of information about someone required extensive, long-term investigation. However, as technology improves, invasive power can be projected from ever-increasing distances, ranging from a Prohibition-era wiretap, to a Kyllo-era thermal scan, to a forthcoming pervasive drone.

  Unless one wishes to be a total hermit, it’s almost impossible to lead a fully private life in the twenty-first century. Since just after the Jones decision, Ohm has written in both academic and popular forums that in recent decades, privacy has often been lost as part of the transactional cost of doing business. If I want to use a cell phone, for instance, I have to give up my location information at all times. If I want to use a service like Uber or Lyft, I have to tell them where I want to go at specific times, and they are effectively allowed to retain that information forever. Under the third-party doctrine, that data can be accessed by the government relatively easily.

  But the Fourth Amendment does not regulate the power of private companies, it regulates government. In America, we have a tradition, going all the way back to the Constitution, of a general skepticism of government’s power, and more of a broad willingness to allow corporate power. Partially, this may be because there are often corporate alternatives. If you don’t like Google, there are other search engines to use. But, there is only one entity that can legally take away your liberty: the state.

  If we assume that the Fourth Amendment is really about power, and not about privacy, what is the proper remedy? For Raymond Shih Ray Ku, a law professor at Case Western Reserve University, the answer is fairly straightforward: let them be regulated by the legislative process.

  “Requiring the use of surveillance technologies to be authorized by statute recognizes that the people should determine just how much power government should wield,” he wrote in a 2002 paper.

  Popular control over government’s power to search was the driving force behind the adoption of the Fourth Amendment. Moreover, requiring statutory authorization for law enforcement’s power to search—even if it is not used to determine reasonableness—would bring search and seizure law in line with the doctrine of separation of powers governing executive power in general. Outside the Fourth Amendment, the Supreme Court is highly skeptical of the executive branch defining its own powers.

  Just as Moore’s law has described the phenomenon of computing power doubling every 18 months, so too is there an analogous effect in the government’s ability to track location data through physical GPS trackers. However, in some sense, the technology described in Jones is already obsolete, less than a decade after the Supreme Court ruled on it. After all, we all already carry tracking devices with us, constantly: they’re called smartphones.

  CHAPTER EIGHT

  How Your Phone Can Lead the Authorities Right to Your Door

  We determine that cell phone users have an objectively reasonable expectation that their cell p
hones will not be used as real-time tracking devices through the direct and active interference of law enforcement.

  —STATE OF MARYLAND V. ANDREWS

  COURT OF SPECIAL APPEALS OF MARYLAND OPINION (2016)

  August 3, 2008

  Santa Clara, California

  On a warm summer’s day, police spotted a man walking outside his apartment in Santa Clara, California, one of the many bedroom communities spread across Silicon Valley.

  Law enforcement—undercover FBI officers—saw him outside the building and began following him on foot, radioing to their colleagues nearby. The man saw the agents, and so he began to walk quickly. They followed suit.

  After months of tracking him via sting bank accounts and confidential informants, the officers had their man. They didn’t even know his name: after watching his activities at a distance, they called him simply the “Hacker.” Between 2005 and 2008, federal investigators believed that the Hacker and two other men filed over 1,900 fake tax returns online, yielding $4 million sent to over 170 bank accounts.

  The Hacker was found out through the warrantless use of a secretive surveillance technology known as a stingray, which snoops on cell phones. Stingrays, or cell-site simulators, act as false cell phone towers that trick phones into giving up their location. They have become yet another tool in many agencies’ toolbox, and their use has expanded with little oversight. While they are used in felony and fugitive investigations, stingrays have also been used to go after 911 hang-ups and other low-level offenses. In 2016, a Capital News Service report described one occasion when the Annapolis (Maryland) Police Department used its stingray to go after someone accused of stealing $56 worth of chicken wings. In short, a tool originally developed for military use overseas was now being used to go after petty takeout thieves.