
Massachusetts Court Blocks Warrantless Access to Real-Time Location Data - Elof
https://www.eff.org/deeplinks/2019/04/massachusetts-court-blocks-warrantless-access-real-time-cell-phone-location-data
======
makeramen
Am I the only one surprised that this is allowed in the first place? What
established practices/precedent does the state have that "it could
warrantlessly get cell phone location data to find anyone, anytime, at any
place as long as it was less than six hours old"?

That seems like precisely the information that should require a warrant, no?

~~~
jasonjayr
The "Third Party Doctrine"

[https://en.wikipedia.org/wiki/Third-
party_doctrine](https://en.wikipedia.org/wiki/Third-party_doctrine)

Everyone storing data in "the cloud" is also at risk, the cloud provider can
voluntarily hand data to law enforcement at their discretion. IIRC this also
comes into play when your email messages are hosted on a 3rd party server that
you do not own.

~~~
rgbrenner
Cloud data and email are protected by the Electronic Communications Privacy
Act:
[https://en.wikipedia.org/wiki/Electronic_Communications_Priv...](https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act)

Under the ECPA they need to obtain a warrant for email and other cloud storage
services, unless it's older than 180 days... then it's considered "abandoned".

There's been some effort to remove the 180 day limit.. some states have laws
that protect older data + the 6th circuit already extended it past 180 days in
US v Warshark.. but we need a national law like the Email Privacy Act that the
House passed last year (but the senate didn't):

[https://www.natlawreview.com/article/house-judiciary-
committ...](https://www.natlawreview.com/article/house-judiciary-committee-
approves-email-privacy-act)

[https://en.wikipedia.org/wiki/Email_Privacy_Act](https://en.wikipedia.org/wiki/Email_Privacy_Act)

~~~
kelnage
You're not wrong, but you've missed the main distinguishing factor between the
Third Party Doctrine and the ECPA.

ECPA is about unauthorised access (think tapping a phone line, but for the
digital age) to electronic communications/cloud data. The Third-Party Doctrine
is explicitly about the Government requesting these records - thus they would
do not fall under "unauthorised access" in the sense used under the ECPA.
Basically they cover two completely different situations.

~~~
randomperson1
I think rgbrenner's point about the ECPA is actually on point in response to
the "IIRC this also comes into play when your email messages are hosted on a
3rd party server that you do not own." comment.

The ECPA isn't just about unauthorized access. It also has provisions, such as
the Stored Communications Act (a subset of the ECPA), that apply to the 3P
situation you described where "Government request[s] these records." For
example, 18 U.S.C. 2703(a) (titled "Required disclosure of customer
communications or records") reads "[a] governmental entity may require the
disclosure by a provider of electronic communication service of the contents
of a wire or electronic communication, that is in electronic storage in ..."

In response to the original comment, the State's position that "it could
warrantlessly get cell phone location data to find anyone, anytime, at any
place as long as it was less than six hours old" was in part based on a
previous Supreme Court case, Carpenter v. United States. Carpenter concerned
federal prosecutors' attempts to get CSLI information using a court order
pursuant to the Stored Communications Act -- 18 U.S.C. 2703(d).

------
phsource
While I personally agree with the ruling, there's a good chance that it will
get appealed (and potentially overturned), since US v. Carpenter, decided back
in 2017, had a narrow holding.

The article mentions that the EFF:

> ...asked the court to recognize, as the Supreme Court did in U.S. v
> Carpenter, that people have a constitutional right to privacy in their
> physical movements.

But SCOTUSblog's reporting of that decision makes it clear that [1]:

> Roberts also left open the possibility that law-enforcement officials might
> not need a warrant to obtain cell-site location records for a shorter period
> of time than the seven days at issue in Carpenter’s case – which might allow
> them to get information about where someone was on the day of a crime, for
> example.

There are two dimensions involved: who's being tracked, and how long it's been
tracked. In Carpenter's case, someone was tracked for 7 days without a
warrant, while in Almonor, it was only 6 hours. Additionally, the EFF post
suggests that this was a much more targeted search (one for specific suspects
only) than the one in Carpenter.

As much as I dislike the idea of warrantless phone tracking, since Roberts
crossed over to vote with the liberals on the side of a narrow majority on
Carpenter, there's a decent chance this might get overturned on appeal.

[1] [https://www.scotusblog.com/2018/06/opinion-analysis-court-
ho...](https://www.scotusblog.com/2018/06/opinion-analysis-court-holds-that-
police-will-generally-need-a-warrant-for-cellphone-location-information/)

~~~
tonyztan
It appears this ruling is based on the Massachusetts State Constitution, not
the U.S. Constitution. States are allowed to have stronger protections against
searches and seizures than what the 4th Amendment requires, and the U.S.
Supreme Court (the only court above the MA Supreme Judicial Court) is unlikely
to have the jurisdiction to interpret state constitutions.

> "Although the defendant raised both federal and state constitutional claims
> in Almonor, the court based its decision solely on Article 14 of the
> Massachusetts Declaration of Rights, which was drafted before—and served as
> one of the models for—our federal Bill of Rights. Article 14, one of the
> cornerstones of the Massachusetts Constitution, is the state’s equivalent to
> the Fourth Amendment. As the court notes, it 'does, or may, afford more
> substantive protection to individuals than that which prevails under the
> Constitution of the United States.'"

(From original article.)

> "the U.S. Supreme Court may hear appeals from state supreme courts only if
> there is a question of law under the United States Constitution (which
> includes issues arising from federal treaties, statutes, or regulations),
> and those appeals are heard at the Court's sole discretion (that is, only if
> the Court grants a petition for writ of certiorari)."

([https://en.wikipedia.org/wiki/State_supreme_court#Influence_...](https://en.wikipedia.org/wiki/State_supreme_court#Influence_of_the_federal_Supreme_Court_on_the_state_supreme_courts))

~~~
phsource
Ah, that makes a lot of sense! I missed that part of the article. It sounds
like the decision is safe in Massachusetts, then!

------
givinguflac
Another sane decision from MA courts, now we just need some of that logic to
trickle up to the national level.

~~~
maxerickson
We probably need legislation at the federal level more than a court decision.

------
0xADEADBEE
As well they should; it sounds objectively like an abuse of privacy. I don't
much care for Google's Sensorvault DB [0] either but at least it's not (AIUI)
real-time and completely unfettered. It'll be interesting to see if projects
like that are considered unethical in a few years too along the same grounds.

[0] [https://www.nytimes.com/interactive/2019/04/13/us/google-
loc...](https://www.nytimes.com/interactive/2019/04/13/us/google-location-
tracking-police.html)

------
tareqak
I think we well on our way to living in a world where corporations become the
enablers for surreptitious yet legal government overreach.

------
mikece
Small victory bit a great first step. Searches by ANY agent of the government
without a warrant, even of private data brokers, that is meant for prosecution
should be illegal.

------
chuckschemer
no problem. just route the request federally

------
wpdev_63
Does this include the FBI/Fusion centers?

~~~
jkaplowitz
The ruling was based on the MA state constitution, so it probably doesn't
constrain federal law enforcement agencies. But it definitely constrains MA
state and local officials, whether or not they're collaborating voluntarily
with the feds in a fusion center.

~~~
wpdev_63
The fact that this has to ruled upon shows how corrupt the institution is.

Rand Paul 2020.

------
duxup
I think we're seeing lower courts quickly coming up to speed on the
ramifications of all this data.

Hopefully it move up to SCOUS.

------
OrgNet
3rd parties (the corporations) are people, so why don't they already need a
warrant to get stuff from them?

------
dlphn___xyz
how hard is it really to get a warrant against someone? it seems like all it
takes is to create reasonable doubt and you now have the “moral highground” to
violate their personal rights

~~~
rando444
A law enforcement officer would first need to have probable cause, then create
a sworn affidavit, then present this to a judge and if the judge agrees, a
warrant is issued.

Search warrants are narrowly scoped. If they find evidence of other law
breaking while executing the warrant, it's inadmissible in court. (unless they
witness these crimes taking place)

They're only allowed to go after the crimes that they are already aware of.

~~~
testvox
That isn't really how it works. The search warrant must be narrowly scoped to
only what is required to investigate the crime for which they have probable
cause. However if they find evidence of other crimes while staying within the
scope of the original warrant they can generally use that evidence at trial.

So for instance if the police have probable cause that a wanted criminal is at
your house they can get a search warrant to search it for him. If while
searching they see illegal drugs on your coffee table they can use that
evidence under the plain view exception. However if they open up your
schoolbag and find drugs they would not be able to use that as evidence
because there is no way a person can fit inside your bag so searching it
couldn't have been part of the search authorized by the warrant.

------
luckyorlame
this is why I donote to both the ACLU and EFF - thank you!

------
drawnwren
It sounds dystopian, but I'm not really sure I disagree with the government
here. We allow our personal data (to include real time location) to be
collected and sold on third party exchanges. I'm not sure there is a strong
argument for the government needing a warrant to access the data given how
freely we already disseminate it.

The solution would be to not disseminate it, but we, as a collective, have
agreed to not make privacy a concern so far.

The biggest irony of all is, as we saw with gdpr, most hn users are nominally
for privacy until regulation is implemented and we realize that we(most
programmers) are the people making a living off of the current state of
privacy.

~~~
rconti
It's interesting how textualism/originalism vs the constitution as a "living
document" plays out. Of course a conservative interpretation of the
constitution might say "the right to bear arms includes rocket launchers"
where a liberal one might say "the founders could not have imagined such a
weapon". In the same way, one could say "if you don't want to be tracked,
don't carry a tracking device on you at all times", where a more liberal
interpretation might be "the framers could not have imagined such an
ubiquitous and useful device, and it's not reasonable to have to sacrifice
modern convenience to maintain the privacy we thought we were guaranteed".

And depending on the issue at stake, a more liberal or more conservative view
might give you greater rights.

~~~
drawnwren
I don't think that applies here. I'm specifically not saying that producing
data makes it public. Rather I'm saying allowing a third party to resell your
data with impunity necessarily obviates your ability to control the
dissemination. If you've given control of your data to a third party, you have
no control. Full stop.

~~~
notbob
If that were true, then wiretaps would be A-OK as long as 1) the phone company
willingly plays along; and 2) the tap never physically intrudes upon the
subject's property.

SCOTUS ruled _explicitly_ on this question in Katz vs. US -- wiretapping is
unconstitutional, regardless of physical intrusion. Just because you route
your voice through a switch owned _and controlled by_ a third part does not
mean you give up your expectation of privacy.

~~~
drawnwren
In that case, you haven't entered into an agreement whereby advertisers may
know the contents of your phone conversations in order to better target you
with ads. If you had, I imagine SCOTUS would rule differently. It seems to me
that this debate is merely about price. If the police were buying your
location data off of a service that offered it, how would they be any
different than advertisers?

~~~
notbob
_> If the police were buying_

That's not what is happening here. The police are not purchasing access like
an advertiser would; they are receiving special access for the purpose of
tracking suspects.

 _> If you had, I imagine SCOTUS would rule differently._

The SCOTUS of the 1960s was very clear -- routing your communication through a
corporate party does not, in any way, negate your expectation of privacy from
your own government!

SCOTUS has changed drastically since the 1960s, and I will be unsurprised if
SCOTUS rolls back every single 'privacy' case that it encounters. But that has
nothing to do with the merits of these cases; it's a way of salting the earth
so that Roe v. Wade can be overturned while appearing less overtly political.

~~~
drawnwren
> That's not what is happening here. The police are not purchasing access like
> an advertiser would; they are receiving special access for the purpose of
> tracking suspects.

Yes, but my point was that we're only arguing about how much someone should
have to spend to gain access.

> The SCOTUS of the 1960s was very clear -- routing your communication through
> a corporate party does not,

But my point, _again_, is that they were _not_ clear that you have some
expectation of privacy after _selling your personal data on an exchange_.

~~~
notbob
I know what your point is. My point is that the courts have considered your
point and don't agree... and for good reason. Your legal analysis basically
amounts to "I don't like that other people use Google's services, and they
deserve to suffer for their complacency".

------
dsfyu404ed
MA generally holds state authority in the highest regards and likewise gives
the cops tons of leeway to do whatever. That a judge in typically
authoritarian state ruled to curtail police power is a pleasant surprise. I'm
not complaining.

~~~
fj39dkf
What a weird thing to say about Massachusetts. It has a constitution and an
elected legislature, so it's definitely not an "authoritarian state". It has
one of the lowest rates of police violence in the country, so I don't
understand the quip about the cops either. Can you clarify?

~~~
ims
Check the post history for this person. There's a weirdly specific and
persistent anti-Massachusetts vendetta.

~~~
dsfyu404ed
Damn straight I do. I know how that sausage is made. If I worked in a
pepperoni factory I'd hate pepperoni. The only reason I don't go around
shitting on things that seem bad about other states is because I don't have
enough information to comment with a high enough confidence that I understand
the big picture as well as the specifics.

