On Wednesday, the United States Supreme Court began hearings on a case that has the potential to be the most important privacy decision in recent memory. At its heart, it’s about the US government’s right to use cellphone data to track a person’s past locations without a warrant. More broadly, it’s about updating the way we think about privacy in the digital age.
Carpenter v. United States comes to the Supreme Court by way of the ACLU. The civil rights organisation believes this case is an opportunity to sort out some of the major legal issues involving metadata being used by law enforcement to obtain convictions. Metadata is data about data, for example: data that describes the location of a nearby cellphone tower. “This case promises to be a landmark case about keeping our privacy rights relevant and vital in the digital age,” Nathan Wessler, a staff attorney for the ACLU told Gizmodo.
In April of 2011, police arrested Timothy Ivory Carpenter in connection with a string of coordinated robberies. A group of men had entered numerous Radio Shacks in Michigan and Ohio at various times, held customers and employees at gunpoint, and filled laundry bags with new smartphones before making a getaway. Several suspects identified Carpenter as one of the orchestrators of the crimes. There were eyewitnesses and video evidence that connected Carpenter to the crimes, but the police also obtained 186 pages of documents from his cellphone carrier that outlined his call history and location data over the course of a 127-day period. Carpenter’s trial lawyer, Harold Gurewitz, told NPR that this is “the kind of evidence that, in the end, is the most difficult to argue to a jury that they shouldn’t credit, because the records are what they are.”
So Carpenter and his attorney appealed his conviction, arguing that his reasonable expectation of privacy had been violated.
The Sixth Court of Appeals ultimately rejected Carpenter’s case based on a precedent set in the ‘70s and ‘80s, the Third Party Doctrine, which established that citizens give up their expectation of privacy when they share information with a third party. In this case, Carpenter had shared his locations with his cellular service just by having a phone on him. The Stored Communications Act of 1986, an amendment to the Electronic Communications Privacy Act, outlined what kind of information that’s stored online can be considered content or non-content. Content can require a warrant that would need law enforcement to demonstrate probable cause. Non-content only requires a subpoena or court order for law enforcement to demand that an ISP turn it over. Today, metadata is considered non-content and is treated with the lower standard that only requires authorities to demonstrate reasonably articulable facts that this data could be related to a crime.
The ACLU has picked up Carpenter’s case because it feels these legal standards can’t possibly apply today when electronic communications can vacuum up every bit of information about your private life, movements, relationships, and activities. “What we’re asking for, in this case, is just that police have to go to a judge, demonstrate probable cause, and get a warrant,” Wessler told us. “And what we’re asking the court to do is to explain to police and the public that a warrant is required for at least a request for longer durations of records. We think anything more than a day.”
Timeframes are essential in this case. Edward J. McAndrew, leader of the National Cyber Incident Response Team at Ballard Spahr and previous federal cybercrime prosecutor at the Department of Justice, told Gizmodo he believes the lower court’s decision was correct based on existing statutes. But only the Supreme Court can decide whether or not metadata in today’s world should qualify as content. The issue we’re facing is that on a long enough timeline, metadata becomes content. He explains:
Even though the data itself is not content, it reveals something that really is, at its base, much like content. It reveals your location over an extended period of time. In fact, what the government does with this data at trial, is it plots it out on a map. So, it actually does turn it into content for purposes of trial. And if it looks like content, and it sounds like content, maybe it is content enough for purposes of a reasonable expectation of privacy, and the requirement of a search warrant.
The court also needs to weigh-in on what constitutes a reasonable expectation of privacy today. When the Third Party Doctrine was adopted, there was only so much information that a person could give up by making a call to someone on a landline telephone. Now, we live in a time when smartphones and internet connections are essential to practically every facet of our lives.
“The court four decades ago could not possibly have imagined the world we live in today, where it’s really impossible to go through our daily lives without records of our most private activities being saved on the servers of companies we have relationships with,” Wessler told us. The fact that we have no choice in giving up this data to third parties, if we want to use their services, could cause the court to reevaluate how it considers our expectations of privacy.
“The choice the government says we have is that we can either opt-out of modern society and not use technology, and protect our privacy,” Wessler said. “Or, we can ‘choose’ to use cellphones and other technologies and therefore sacrifice our privacy. That just can’t be the rule.”
This conundrum goes beyond the way the law carries out procedures. It hits on something almost existential. Society has become accustomed to clicking past the Terms of Service for a tech company without reading it, and we all just accept that we have to give up our privacy to get by in the world. While Mark Zuckerberg famously claimed that privacy is no longer a “social norm,” it’s less a case that people don’t expect privacy, and more that a new social norm has been foisted on us. So, we have to ask if the government will protect our expectation of privacy even though it’s being pried from our hands one click at a time.
Wessler says the ACLU is asking the court not to overrule the previous cases that used the statutes that are under debate, but “to reject the government’s invitation to radically extend this to this very new digital world we’re in.” Above all, the group just wants to see the more rigorous standards of requesting a warrant to be applied in these situations. “Now, the court is very unlikely to answer the question of what the rule should be for all the other kinds of sensitive digital data stored somewhere in the cloud,” Wessler told us. But by redefining how location data is treated, the Supreme Court’s decision and reasoning could create a domino effect in lower courts, state legislatures, and Congress to address other types of data.
No one we spoke with for this story felt like the case will split along partisan lines in a 5-4 decision. In Riley v. California, the court decided that police need a warrant to search a cellphone, as Chief Justice John Roberts, a conservative, wrote:
The storage capacity of cell phones has several interrelated consequences for privacy. First, a cell phone collects in one place many distinct types of information—an address, a note, a prescription, a bank statement, a video— that reveal much more in combination than any isolated record. Second, a cell phone’s capacity allows even just one type of information to convey far more than previously possible. The sum of an individual’s private life can be reconstructed through a thousand photographs labeled with dates, locations, and descriptions; the same cannot be said of a photograph or two of loved ones tucked into a wallet. Third, the data on a phone can date back to the purchase of the phone, or even earlier. A person might carry in his pocket a slip of paper reminding him to call Mr. Jones; he would not carry a record of all his communications with Mr. Jones for the past several months, as would routinely be kept on a phone.
In United States v. Jones, the court decided that sticking a GPS-tracker on a suspect’s car without a warrant constituted trespass. The decision avoided making a determination about whether a person’s location in public was something that they could reasonably expect to be private, but Justice Sonia Sotomayor did write that the Third Party Doctrine is, “ill-suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”
The court isn’t expected to make a decision until at least June of next year, but McAndrew told us that if you want to get a feeling for which way the justices are leaning, pay attention to whether or not they’re asking questions in personal terms. “When they tend to say things in personal terms, which a lot of judges do when talking about technological issues, it’s because they’re literally thinking about their own privacy,” he says.