
Cops can easily get months of location data, appeals court rules - pavornyoh
http://arstechnica.com/tech-policy/2016/05/cops-can-easily-get-hundreds-of-days-of-location-data-appeals-court-rules/
======
RKearney
So it looks like the problem is the third-party doctrine, which is described
as "the 1970s-era Supreme Court case holding that there is no privacy interest
in data voluntarily given up to a third party like a cell phone provider."

But people aren't voluntarily giving cellular providers this data, right? I
mean, I never saw that prompt on my phone asking if Verizon could have access
to my location.

Of course the truth is Verizon/AT&T/others collect this data every time your
phone hits a tower, but how many customers actually understand this? Is it
outlined in the service agreement? I'll admit I've never actually read the
whole thing before and just assumed it was the usual yadda yadda. But even if
it did mention they collect location data, could I then opt-out or say I do
not consent to have my location monitored and collected? Would that then
protect me from data searches? Probably not...

I maintain a large amount of Wi-Fi networks in various locations across the
US. While we have the ability to monitor the signal strength of every device
and use trilateration to obtain a location, we don't do this. But, if we did,
does that mean anyone our wireless picked up "voluntarily" gave me this data,
and then I would have to give it up to law enforcement at a moments notice?

I'm getting really tired of seeing centuries old laws being cited in 2016's
technology.

~~~
appleflaxen
My understanding of the argument is that the _customer_ has no privacy
interest if somebody they voluntarily gave information to (the phone company)
voluntarily gives it to the police.

Which is hard to argue with: if you tell me a secret, you lose the ability to
control the information. (you have no "interest" in my willingness to share
the secret).

but IANAL, and am happy to be corrected

~~~
mooreds
> third-party doctrine, the 1970s-era Supreme Court case holding that there is
> no privacy interest in data voluntarily given up to a third party like a
> cell phone provider.

I don't think the issue is how the cell phone companies give the info to the
government (voluntarily or involuntarily), but rather that because you, the
consumer, "gave" your location info to the cell phone company "voluntarily",
you have no privacy rights with respect to that info.

Quotes because the definitions seem fuzzy to me (and to the defendant's
lawyers, apparently).

I am not a lawyer.

------
bpchaps
This whole "open data" and "Freedom of information" thing is really falling
short on me these days. As I keep going further in attempting to get Chicago's
office of the mayor's communication records, I keep getting more and more push
back. 4/5 times it's essentially, "We don't have the infrastructure to make
your request possible." The remainder is either incompetence or "malice".

Why does it take an extreme amount of effort, a year and a half (and
counting!) to receive government communications (which is considered within
the public domain) when these guys have such amazing ease doing the same
towards the general public? It's unbelievable.

Here's part of a response I got today after requesting communications -
including email - for six of the numbers's communications, derived from [0]:

 _The email system’s tool set cannot identify the department where an email
user works, and therefore, a search cannot be based on a department.
Parameters that would assist the Mayor’s Office in conducting an email search
include: (1) the e-mail address of the account you wish searched; and (2) the
e-mail address of each individual’s mailbox, if you seek e-mail correspondence
to and from two individuals._

After dozens of these, the only way I read responses like that is, "We're not
clever enough, or willing enough to work with other departments to help you
out. You're probably going to give up after this rejection, but if you don't,
you'll give up eventually."

To get around that, I submitted a FOIA request to their IT FOIA group
requesting the domain names/sent times for all emails sent out of the mayor's
office. Just so that I can get the the timeframes for the Mayor's office to
search through.

And.. just to add to the fun in attempting to prevent more rejections, another
request to their IT department to send me their DNS resolution logs for the
timeframe in [0]. Oddly, I don't think they can claim unduly burdensome on
this one, either, since it's just pulling log files with maybe some awk
commands and some nslookups on a machine outside their network to check if
it's in "public domain".

[0]
[https://docs.google.com/spreadsheets/d/1hgG79eIr8MbkjYrCvcTR...](https://docs.google.com/spreadsheets/d/1hgG79eIr8MbkjYrCvcTRN8n876KL8aXYYu5it8Lg0g8)

~~~
jacquesm
They will simply claim not to be logging that.

~~~
bpchaps
Spilled milk, etc. Mayor's office said that about the linked spreadsheet, too.

If that happens, then I'll either look somewhere else for equally relevant
information, or just focus more on the two other ongoing legs. :)

A rejection like that isn't necessarily a bad thing with research like this.
Knowing about what's available and what's not is incredibly useful and makes
similar requests easier in the future. It also helps gauge how a group will
handle a request. For example, knowing that the FOIA officer consistently
doesn't know FOIA that well means I don't have to bug my lawyer as much.

------
Floegipoky
This seems ridiculous, it's pretty clear that the government had enough
evidence to justify a warrant to for the location data- they had already
obtained one to search the phones. The difference here is purely procedural,
of course the court is going to refuse to overturn a guilty verdict just
because they asked for a court order instead of a second warrant. And now we
have this shitty law.

~~~
BeefySwain
*precedent, not law.

------
themartorana
There should be nothing - NOTHING - that is searchable/obtainable without a
warrant. The entire point is that more than one person has to review the
desire to collect information.

Want to draw my BAC? Put a judge on staff at the hospital. The point is not to
encourage drunk driving, it's that the law gives no single person dominion
over another, that one person cannot by force of law exert state-backed power
over another.

I realize this would set up a bunch of rubber-stamp courts, but even that is
light years better than warrantless anything.

Edit: the entire point is there are some rights we value over everything -
including safety.

~~~
dragonwriter
If you want that to be the law, you need to amend the Constitution to create
an unconditional warrant requirement, rather than a reasonableness requirement
and standard for using warrants.

~~~
themartorana
I would be for that. "Reasonableness" is something recent courts and I (and
many here) really disagree on.

~~~
darawk
Would you allow firefighters to enter a burning building without a warrant?
What about entering a home to stop an in-progress murder?

The argument that a court should be required in _all_ circumstances is pretty
silly.

~~~
pdkl95
> Would you allow firefighters to enter a burning building without a warrant?

Firefighters enter buildings for public safety, not to search for contraband
or evidence.

> What about entering a home to stop an in-progress murder?

That is only allowed in rare exigent circumstances[1] that involve the
_imminent_ danger. While the plain view doctrine can apply in such a
situation, exigent circumstances do _not_ allow for searching in places that
normally require a warrant.

> The argument that a court should be required in all circumstances is pretty
> silly.

Requiring a warrant in _all_ circumstances where the government wants to
_search_ and/or _seize_ evidence is a cornerstone of a free society. Warrants
are a trivial barrier _if_ there is a legitimate investigation with any
evidence at all. The "probable cause" requirement is a very low barrier.

Some people complain that warrants are "rubber stamped" too easily, but
getting the "stamp of approval" is the goal. It's easy to start skipping[3]
simple requirements like "probable cause", so a warrant acts as a check and
audit trail that at least some minimal procedure was followed.

[1]
[https://en.wikipedia.org/wiki/Exigent_circumstance](https://en.wikipedia.org/wiki/Exigent_circumstance)

[2]
[https://en.wikipedia.org/wiki/Plain_view_doctrine](https://en.wikipedia.org/wiki/Plain_view_doctrine)

[3] [http://www.rapp.org/archives/2015/12/normalization-of-
devian...](http://www.rapp.org/archives/2015/12/normalization-of-deviance/)

~~~
darawk
I'm aware of all of these things. But as your second citation points out, an
officer legally entering a building during an exigent circumstance may
confiscate and/or use as evidence anything found in 'plain view'.

> Requiring a warrant in all circumstances where the government wants to
> search and/or seize evidence is a cornerstone of a free society. Warrants
> are a trivial barrier if there is a legitimate investigation with any
> evidence at all. The "probable cause" requirement is a very low barrier.

We just went over a variety of obvious exceptions to the warrant requirement.
You can argue that these are exceptional cases to be sure, but it is certainly
not true that a warrant is always required nor should it be (as the comment I
was responding to said).

A very slightly less clear-cut example is BAC, as the parent commenter
mentioned. It is completely impractical to get a warrant in DUI cases. It
would either be a completely meaningless waste of everyone's time, or it'd
literally be a rubber stamp, where a cop calls up and receives the warrant
with zero interaction or consideration from the judge. And I don't know about
you, but i'd rather not open the door to _true_ rubber-stamping of warrants.
Because once you start doing that, it's only a matter of time until they start
doing it with things that aren't so trivial.

~~~
Avshalom
I'm pretty sure that if a firefighter breaks into my house to put out a fire
the cops still have to have had a warrant for anything found in the house to
be admissible in court.

~~~
darawk
Not so if there is evidence of a crime in 'plain view'.

------
kaosjester
In the near future, criminals will learn to leaves their cellphones at home
while committing crimes, using burner phones for any contact they need during
that time.

Which, incidentally, is advice that the Shadowrun tabletop RPG gives freely as
advice to would-be players...

~~~
pdkl95
> leaves their cellphones at home while committing crimes, using burner phones
> for any contact they need during that time

That's getting a _lot_ harder to do in practice. OPSEC is hard when you have
to care about stuff like overlapping usage of the burner so the movement logs
of the regular phone stopping don't correlate with when the burner starts
moving.

Zoz gave a great overview[1] of modern cellphone OPSEC at DEFCON 22.

[1]
[https://www.youtube.com/watch?v=J1q4Ir2J8P8#t=2292](https://www.youtube.com/watch?v=J1q4Ir2J8P8#t=2292)

------
HappyTypist
What's the business justification for retaining cell tower logs for 221
days?!? Surely they can be anonymised after two weeks.

------
uptown
So faraday bags when you're not using your device? Which ones actually work?

~~~
homero
Microwaves work

~~~
uptown
Not exactly a portable solution.

~~~
homero
Foil seems to work

