Federal Court Finally Sets Some Limits On Cell Phone Ping Warrants

This is something that should have happened years ago, but I guess we can be grateful it's happening now. And part of the reason it's finally happening is because of the warrant requirement for obtaining historical cell site location info created by the Supreme Court's Carpenter decision.

One of the many ways the government obtains cell site location info is with ping warrants. These warrants are a little weird. The information the government is asking for doesn't actually exist yet. So, that makes normal warrants useless because the government can't normally obtain a warrant allowing them to search for and seize evidence that doesn't actually exist when the warrant is served.

It's basically tracking without having to install a tracking device. This quasi-warrant is handed to a service provider but acts more like a court order mandating the generation of cell location pings" so the government can grab them at its earliest convenience. In some cases, that means just hanging out at a provider's office watching the pings in near real-time.

To get around this, the warrants are combined with pen register/trap and trace orders. These are normally used to collect information about phone numbers called/received by the target phone number. These records are normally generated by service providers, but generally aren't considered to be something law enforcement can access in real time.

Then there are the modifications to Rule 41, which has generally just allowed federal officers to do whatever they want, wherever they want, however they want. (I'm simplifying, but that's kind of how it's gone over the last decade or so.)

All of that comes together in this recent court order [PDF], issued by a New Mexico federal court, which says the government can't just mix and match authorities to gather real-time location info just because no court has ever said it can't. (via FourthAmendment.com)

This court has plenty to say on the matter, and it's a thoughtful order, even if it does dive deep into the weeds on occasion.

The government theorizes this is legal under the Stored Communications Act, even if the records it's seeking haven't even been generated yet and likely would not have been stored in the absence of court order stating otherwise. And if it isn't quite legal under this authority, the government tries to cover its bases by adding more paperwork that still doesn't quite exactly pertain to the information being sought by investigators.

The upshot of the order is this:

For the reasons below, the Court denies the United States' ping warrant application. It finds that 1) the SCA does not, on its own, permit the government to obtain prospective location information, but that 2) the SCA in combination with the Pen/Trap Statute does permit such prospective information. This combination 3) renders the cell phone a tracking device subject to the TDS [Tracking Device Statute] and procedural requirements for tracking devices under Rule 41.

This conflict was initiated by the recipient of these convoluted orders that borrowed language from three different search authorities in hopes of creating a cohesive whole. What's hilarious is that the cell phone company receiving these orders has been rejecting these warrants for a decade straight:

For at least the last ten years, the United States has been submitting requests for ping warrants in a format substantially similar to the ping warrant currently at issue. Part of the United States' stock language has included a request to order a cell phone company to create location records by initiating a signal (pinging" the suspect's cell phone) so that law enforcement could then seize the record. And for the past ten years, the undersigned has been rejecting this request by either having the United States resubmit applications that do not contain this language or by crossing this language out from the search warrant attachments it authorizes.

The problem with that language was obvious to the service provider. And it was obvious to this court, which shot down the government's attempt to have the court order the company to comply with one of its more recent warrants.

The Court found that compelling a third party to create records it would not have otherwise created so that law enforcement could then seize those records went beyond the scope of Federal Rule of Criminal Procedure 41 and 18 U.S.C. 2703(c)(1)(A), the authority on which the United States based its request. Accordingly, the Court denied the warrant application.

Yeah, that's some bullshit. The government shouldn't be able to force third parties to generate information purely for government use in criminal cases. And if that's what's happening, a federal officer can't plausibly claim there's probable cause to believe the service provider has these records since they don't actually exist until after the company has started pinging the target phone to comply with the mutant PR/CSLI/Rule 41 hobgoblin federal agents claim mandates compliance.

The government tried again, this time stripping the initiate a ping" language from the warrant request. The court requested more discussion and brought in a representative from the federal public defender's office to provide an adversarial take. The DOJ then claimed the issue was moot because it wasn't demanding ping initiation. Everything went quiet for a few weeks and then the government showed up again in this same court with another order in another case... with the ping initiation language brought back into the mix.

Since the government isn't interested in policing itself, the court's going to have to do it. So, now there are some rules on ping orders it will have to follow:

The Court finds that the SCA is insufficient, on its own, to allow for prospective, rolling production of cell phone location records at all times day or night. However, the SCA can operate in conjunction with the Pen/Trap Statute to establish this authority. If these statutes operate in conjunction, the cell phone for which records are obtained becomes a tracking device subject to the notice provision in Rule 41 and the notice-extension provision in 18 U.S.C. 3103a. Because a cell phone becomes a tracking device and the Pen/Trap Statute requires an installation, the jurisdictional provision of the TDS applies and the government will need to
establish probable cause that the phone will be in the District of New Mexico when the installation occurs (i.e., when tracking begins).

Warrants requesting location records over a fourteen-day period but not requiring the phone companies to provide the records on a rolling basis will not be considered tracking warrants and need only comply with the requirements of the SCA, not the hybrid approach described above. In other words, because the phone will not operate as a tracking device under these circumstances, Rule 41 procedures for tracking devices will not apply.

Going forward, for warrants submitted to the undersigned, the Clerk's Office will also conduct an initial screening to ensure that the warrants the United States submits do not contain administrative errors. For warrants seeking to track a person's movement in real time through the cell phone that person carries (similar to the ping warrant at issue here), agents should use Form AO 102. [...] Warrant applications must not include a request to compel phone providers to initiate a signal" as the United States has represented that when such a request is submitted, it is submitted in error. The Clerk's Office will summarily reject tracking warrant applications submitted to the undersigned that do not comply with these procedures.

There is little doubt the DOJ will attempt to appeal this order. This order means it has to treat targeted phones like the tracking devices investigators treat them as when serving ping warrants. It can't pretend it's just a bunch of stored information completely untethered from the location info it seeks to access in as near to real-time as possible. But the government doesn't like to play by the rules, even if the rules just ask it to be a tad bit more constitutional. For now, the order stands. And law enforcement officers operating in New Mexico will have to comply until someone says otherwise.