Understanding & Challenging Location Tracking Hanni M. Fakhoury EFF Senior Staff Attorney

y_police_ s.pdf

y_police_ s.pdf “In the past, and at the request of the U.S. Marshalls, the investigative means utilized to locate the suspect have not been revealed so that we may continue to utilize this technology without knowledge of the criminal element, in reports or depositions we simply refer to the assistance as ‘received information from a confidential source regarding the location of the suspect.’”

US v. Rigmaiden, 844 F. Supp. 2d 982 (D. Ariz. 2012) & 2013 WL (D. Ariz. 2013)

Hemisphere Database of CDRs available in near real time regardless of carrier –Includes records made 2 hours after a call –Results returned in hours for exigent circumstances and 2-5 days for routine requests –At least 10 years worth of records Used to –Find dropped/new/additional phones –Determine some location information –CDRs on international numbers

Hemisphere

“Protecting” Hemisphere Administrative subpoena to get Hemisphere records “Parallel subpoening” –Hemisphere used as a “pointer” system to be followed up by a subpoena to carrier No reference to Hemisphere in official reports or court documents –Just reference to follow up subpoenas

US v. Ortiz, 12cr119 (NDCal) Defense obtained subpoena ordering disclosure of: –Court orders authorizing HIDTA to release CDRs to law enforcement –Correspondence between law enforcement and Hemisphere

DEA Bulk Records Collection Collection of phone records made from US to 116 countries from –numbers, time and date of call and length of call Database queried if reasonable articulable suspicion phone associated with criminal activity DEA’s SOD passed info as tips to field agents and local law enforcement –Database not referenced in official reporting

Discovery Other “Stingray” Terminology –IMSI catcher, digital analyzer, cell site simulator, triggerfish, stingray, kingfish, amberjack, hailstorm, WITT (FBI’s “wireless intercept tracking team”) Descriptions of the Technique –Cellular or cell phone tracking –Pinging –“Ride by” –“Known investigative technique”

US v. Kincaid, 13cr818 (NDCal)

US v. Kincaid, 13cr818 (NDCal)

State v. Taylor,

Expectations of Privacy Rakas v. Illinois, 439 U.S. 128, 143 n. 12 (1978) –Must “have a source outside of Fourth Amendment” by reference to “understandings that are recognized and permitted by society” Riley v. California, 134 S.Ct (2014) –Privacy interests depend on the quality and quality of information revealed –Older cases involving physical items or less intrusive government action don’t control digital searches or surveillance

Expectations of Privacy US v. Knotts, 460 U.S. 276 (1983) –No expectation of privacy in public movements “voluntarily conveyed” to others –Reserved right to consider “dragnet-type law enforcement practices” Smith v. Maryland, 442 U.S. 735 (1979) –Use of pen register to capture outgoing phone calls made over three days –No expectation of privacy in dialed phone numbers

Location Privacy Subjective expectation of privacy –Location info revealing when aggregated –Phone records may be protected under state constitution Expectation is objectively reasonable –Growing body of case law and statutory protection reflect changing “understanding” Smith Doesn’t Apply –Nature of intrusion matters

Location Privacy US v. Cooper, 2015 WL , at *8 (N.D. Cal. Mar. 2, 2015) –“Society's expectation of privacy in historical cell site data is also evidenced by many state statutes and cases which suggest that this information exists within the ambit of an individual's personal and private realm… While state law is, of course, not dispositive on this question, ‘the recognition of a privacy right by numerous states may provide insight into broad societal expectations of privacy.’”

Location Privacy Warrant to track car with a GPS device –U.S. v. Maynard, 644 F.3d 544 (D.C. Cir. 2010); People v. Weaver, 909 N.E.2d 1195 (N.Y. 2009); State v. Campbell, 759 P.2d 1040 (Or. 1988); State v. Jackson, 76 P.3d 217 (Wash. 2003); Commonwealth v. Rousseau, 990 N.E.2d 543 (Mass. 2013); State v. Brereton, 826 N.W.2d 369 (Wis. 2013); State v. Zahn, 812 N.W.2d 490 (S.D. 2012); U.S. v. Lopez, 895 F. Supp. 2d 592 (D. Del. 2012) Warrant statutorily required to track cell phone –Historical & real time: CO, ME, MN, MT, UT –Real time only: IL, IN, MD, VA, WI

Location Privacy Warrant required to obtain cell phone location records –Tracey v. State, 152 So.3d 504 (Fla. 2014); Commonwealth v. Augustine, 4 N.E.3d 846 (Mass. 2014); State v. Earls, 70 A.3d (NJ 2013); Commonwealth v. Rushing, 71 A.3d 939, (Pa. Sup. Ct. 2013), appeal granted on other grounds 84 A.3d 699 (2014); United States v. Powell, 943 F. Supp. 2d 759, (E.D. Mich. 2013); United States v. White, --- F.Supp.3d ---, 2014 WL (E.D.Mich. 2014) (real time) –But see U.S. v. Davis, --- F.3d ---, 2015 WL (11th Cir. 2015) (en banc); In re US for Historical Cell Site Data, 724 F.3d 600 (5th Cir. 2013); In re US for an Order, 620 F.3d 304 (3d Cir. 2010)

x