Massachusetts' Top Court Says Warrants Are Needed For Real-Time Cell Site Location Info

Five years ago, the Massachusetts Supreme Judicial Court got out ahead of the tech curve by declaring that state law enforcement would need warrants to seek historical cell site location info. This predated the US Supreme Court's Carpenter decision by four years. The state court's prescient decision was compelled by the state's Constitution, which provides greater protections than the United States' Constitution.

But no matter which Constitution was used, the court found that the Third Party Doctrine shouldn't cover CSLI because, while everyone uses cellphones to communicate with each other, not a single cellphone user carries one around just to create tracking data for the government.

A recent decision by the same court expands protections for cellphone users -- going further than Carpenter's protection of historical cell site location info. As the ACLU's Kade Crockford points out, real-time acquisition of location info now comes with a warrant requirement. This covers more than service provider-assisted "pings." It also covers one of law enforcement's favorite toys.

Crucially, the ruling takes a different approach from the Supreme Court's Carpenter decision in one key respect: Instead of confining its mandate to the narrow circumstances of the case before the Court, the ruling extends the warrant protection to other types of real-time cellphone tracking, including where the government uses its own technology rather than requesting the assistance of cellphone companies. In a huge victory for Massachusetts residents, the ruling explicitly specifies that it additionally applies to law enforcement's use of so-called "stingrays," also known as cell-site simulators, or devices that police can use to directly track cellphones-enabling police to cut out the cellphone company from the equation entirely.

As the court points out in its decision [PDF], manipulating a person's phone to reveal its location has nothing to do with third-party records or phone users' implied relinquishment of this tracking data. The only party involved is the government. The service provider may be involved, but the phone's owner certainly isn't.

The intrusive nature of police action that causes an individual's cell phone to transmit its real-time location raises distinct privacy concerns. When the police ping a cell phone, as they did in this case, they compel it to emit a signal, and create a transmission identifying its real-time location information. [...] This action and transmission is initiated and effectively controlled by the police, and is done without any express or implied authorization or other involvement by the individual cell phone user. See id. (noting that cell phone ping is "undetectable to the [cell phone] user"). Without police direction, such data would also not otherwise be collected and retained by the service provider.

This active inducement of a signal, solely for the purpose of locating a phone, is something invasive enough it requires a warrant. Since that's all Stingrays do -- induce all phones in the area to cough up identification/location info -- there's no way Stingrays aren't covered by this ruling. The court is clear law enforcement means and methods that subvert societal expectations are unreasonable. Hence the need for warrants.

We confidently conclude that such police action implicates reasonable expectations of privacy. Indeed, society reasonably expects that the police will not be able to secretly manipulate our personal cell phones for any purpose, let alone for the purpose of transmitting our personal location data.

The footnote attached to this paragraph specifically references Stingray devices. And it makes it clear this ruling covers whatever new tech/method law enforcement uses to obtain real-time location info, preemptively instituting a warrant requirement for future tech developments.

We recognize that the government's ability to compel a cell phone to reveal its location is not limited to the pinging that occurred in this case. For instance, law enforcement in other jurisdictions have used "cell site simulators" to track down persons of interest by "trick[ing] all nearby phones" into revealing their location information (quotations omitted). State v. Andrews, 227 Md. App. 350, 379 (2016). Nor do we doubt that as technology continues to advance, the government will develop new ways to compel an individual's cell phone to reveal its location. The privacy concerns raised by pinging a cell phone apply equally to any circumstance where the cell phone's location information is generated as a direct result of the government's manipulation of an individual's cell phone.

It's a solid ruling. And it shows some states are going to set the pace in tech/privacy cases simply because their state Constitutions provide residents with more protections than are found at the federal level. If we can't get a unified stance from the top court in the land, maybe we can piece it together state-by-state.