Supreme Court Says Warrant Needed to Grab Cellphone Location Data

Photo by rawpixel

Just when you think you have a beat on the Supreme Court, they always seem to surprise you. Take the decision issued in Carpenter v. U.S., issued last Friday, June 22. The court held that a judicial warrant, based on probable cause, is required before law enforcement officials can call up your cellphone company and find out where you've been every few minutes for a given period of time.

Perhaps you saw the 5-4 decision in favor of Timothy Carpenter coming; but, admit it, you probably thought it would divide along the traditional conservative-liberal lines. It didn't. Instead, we got an opinion written by Chief Justice Roberts, appointed by President George W. Bush, joined by liberal Justices Ginsburg, Sotomayor, Kagan, and Breyer; conservative-leaning Justices Thomas, Alito, Kennedy, and Gorsuch dissented.

Where did that split come from? Who knows? Perhaps it starts with the fact that this was a very complicated case, if you analyze it based strictly on legal precedent. The court was faced with plenty of past cases pointing in both directions, enough that any possible combination of the nine justices could have been in play.

Before looking at the Roberts opinion, let's review the facts. Timothy Carpenter was one of several men connected to a series of robberies at Radio Shack and T-Mobile stores in Detroit. Four suspects were arrested in 2011, one of whom confessed both (a) that the group had robbed several stores in Michigan and Ohio over the prior four months and (b) that there were 15 different accomplices. The suspect gave the FBI the cellphone numbers of some of the group.

Armed with that information, here's what law enforcement didn't do:

• actually search anyone's cellphone,
• hide a camera to spy on anyone,
• eavesdrop on anyone's phone conversations, or
• enter anyone's private home or search any private papers.

Instead, law enforcement demanded information that cellphone companies already had in their computers: logs of the locations of each customer over a period of time (at least when the phones are turned on). That data is often retained for quite a long time and, in fact, the data obtained here covered 127 days and tracked 12,898 location data points of where the targets had gone with their cellphones.

That's a whole lot of information; in fact, you may not even know that your phone company keeps all that data about you; but they do. Companies keep track of where all of the roughly 400 million cellphones (a number notably higher than the 326 million people living here) in this country wander around. If they didn't have this information, they couldn't find you when someone called you, and they wouldn't have all the information they need to manage their networks. Whether they need to keep individual location data for as much as 127 days is a different matter, but the length of time was not itself at issue in the litigation.

What are some of the past precedents applicable in this case? On one hand, Americans have an expectation that they may move about the country at will and that their physical movements are their own private business. On the other hand, while we have an expectation of privacy in our own records, the law does not extend that expectation to records created and held by others. Past cases have balanced these considerations by allowing law enforcement to find out what telephone numbers you called and placing a tracker on your car to allow officers to follow you for a short time, all without a warrant. But without a warrant, they can't eavesdrop and listen to your words or hide a GPS device to track everywhere your vehicle goes.

So how did the court resolve these competing considerations: where cellphone tracking is done (and records collected) by the phone company, not the customer, and where the company both creates and possesses the data, so that the data can be searched without any action by the customer?

Photo by Claire Anderson

Chief Justice Roberts concluded that if you combine the expectation of privacy regarding physical movements, the extreme depth and detail of the information available from cellphone tracking, and a feeling that no one can survive today without a cellphone turned on all the time (so you can't practically do much to avoid collection of the data), that the total combination is just too much to allow searches without judicial supervision. He said that new technologies have changed our society so fundamentally that the courts must rethink some of the old privacy expectation principles and adapt them to the new always-connected world.

A key element of this is the notion that a person does not surrender privacy rights by "venturing into the public sphere." With regard to cellphone records, though the records are generated by third parties for commercial purposes, the individual account holder retains an expectation of privacy in those records. This, as Justice Roberts said, is because cellphones provide "an intimate window into a person's life, revealing not only his particular movements, but through them his 'familial, political, professional, religious, and sexual associations.'"

Relying on that more functional notion of an individual's privacy expectations rather than a strict view of who is actually holding the information being sought (the individual or a third party) would seem to be a seismic shift in this area of the law, especially to the extent that a court might decide how much a privacy right matters in an individual case.

The court, however, went out of its way to say that its decision was a narrow one and should not be taken as a signal as to what they will do in future cases - and one can envision any number of future cases in which this precedent will be cited with attempts to apply or distinguish it, depending on who is arguing. For example, can law enforcement ask a cellphone company for instantaneous data necessary to stop a fleeing suspect? And what about social media data, which is voluntarily shared with others (though not necessarily everyone)? After all, some people post everything about themselves on Facebook, Instagram, or on other platforms - where they go, what they eat, and even for some when they burp - and they do it voluntarily. Have they relinquished their privacy expectation for their postings, even if only their "friends" can see them?

What will happen in future years as other privacy expectations arise or evaporate? The Justices took one fork in the road this time, but they didn't blow up the intersection, leaving open the possibility that they will move down the other fork in a future case, all the time hoping (perhaps futilely) that their own cellphones aren't being tracked.