Am I the only one surprised that this is allowed in the first place? What established practices/precedent does the state have that "it could warrantlessly get cell phone location data to find anyone, anytime, at any place as long as it was less than six hours old"?
That seems like precisely the information that should require a warrant, no?
Everyone storing data in "the cloud" is also at risk, the cloud provider can voluntarily hand data to law enforcement at their discretion. IIRC this also comes into play when your email messages are hosted on a 3rd party server that you do not own.
Under the ECPA they need to obtain a warrant for email and other cloud storage services, unless it's older than 180 days... then it's considered "abandoned".
There's been some effort to remove the 180 day limit.. some states have laws that protect older data + the 6th circuit already extended it past 180 days in US v Warshark.. but we need a national law like the Email Privacy Act that the House passed last year (but the senate didn't):
You're not wrong, but you've missed the main distinguishing factor between the Third Party Doctrine and the ECPA.
ECPA is about unauthorised access (think tapping a phone line, but for the digital age) to electronic communications/cloud data. The Third-Party Doctrine is explicitly about the Government requesting these records - thus they would do not fall under "unauthorised access" in the sense used under the ECPA. Basically they cover two completely different situations.
I think rgbrenner's point about the ECPA is actually on point in response to the "IIRC this also comes into play when your email messages are hosted on a 3rd party server that you do not own." comment.
The ECPA isn't just about unauthorized access. It also has provisions, such as the Stored Communications Act (a subset of the ECPA), that apply to the 3P situation you described where "Government request[s] these records." For example, 18 U.S.C. 2703(a) (titled "Required disclosure of customer communications or records") reads "[a] governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in ..."
In response to the original comment, the State's position that "it could warrantlessly get cell phone location data to find anyone, anytime, at any place as long as it was less than six hours old" was in part based on a previous Supreme Court case, Carpenter v. United States. Carpenter concerned federal prosecutors' attempts to get CSLI information using a court order pursuant to the Stored Communications Act -- 18 U.S.C. 2703(d).
Large companies, especially public ones and those doing business with the government, follow different sets of rules specifying retention times. For anything that has an impact on accounting, the minimum is usually 5 years. If you’re trying to get an FAA approval for anything that flies, it’s much longer.
Bonus: the 180 days mentioned above is for third party service providers as the cutoff of considering information to be “in transit”. Is has absolutely no bearing on in-house systems which have first-party protection.
It's worth nothing that's for the federal question, although it's certainly relevant here too.
As far as the Massachusetts Constitution, two of the judges here held that this type of location data is protected. The majority focused on the government action (it's not third party if the police actively cause a third party to do something), but the broader question might get revisited in a later case.
If they dont make it public to everyone they shouldnt plainly make it public to the government. In an age of identity theft and smarter high tech criminals this sort of data should be on lockdown and under scrutiny for access.
United States v. Graham held, with significant controversy, that obtaining historical location data from a phone company is shared with a third party and so lacks 4th Amendment protection.
But the Massachusetts court finding for this case centered on the ping; law enforcement can't ask third parties to conduct specific searches in its place, which was effectively what they did here. (Similarly, there's a standing case about the FBI use of paid GeekSquad informants which hinges on whether they were being paid for discoveries in the course of work, or implicitly hired to conduct searches.)
That said, two judges here held that even if the Fourth Amendment doesn't protect location data, the Massachusetts constitution does. So once the targeted-request program ends, we may see this question revisited.
> What established practices/precedent does the state have that "it could warrantlessly get cell phone location data to find anyone, anytime, at any place as long as it was less than six hours old"?
There's precedent allowing use of such data without a warrant where there is an immediate need, but probably no clear boundary in precedent: taking a broad interpretation of authority which clearly exists in some form until courts have drawn a clear demarcation is not at all unusual.
> That seems like precisely the information that should require a warrant, no?
No, I think the set of legitimate warrantless access to such data (the exigent circumstances the court refers to) would be a subset of the set of less-than-six-hour-old data, so the limitation the State appl d is in the right direction though still very much too broad; if it only allowed historical but not current data, then it would be precisely the information that should require a warrant rather than a far-too-broad line around legitimate warrantless access.
In the US, the typical consensus for law enforcement & government entities, is basically use whatever's available that's beneficial and when nothing has been written into law about it. So I doubt warrant covers much about digital data and that can be accessed from third parties or intercepted when traveling over the air with special devices.
A common feature of our modern society is that bad actors will take illegal actions and rarely/never face repercussions. This emboldens them to further do more illegal things. Meanwhile, the courts take months or years to reach decisions (especially regarding technology) and in the passing time the practice becomes normalized [1] or already the damage is done. Perhaps in that time new technological paradigms create fuzzier muddier waters and the same crimes "can" continue "legally" while the courts decide, yet again.
It is a flaw in our current system. It is most obvious at the federal level, where the President and many Republicans routinely break laws in obvious manners, while the courts fight it out for years.
[1] Some of our laws are based on what is 'normal'. So after some years of a practice taking place clearly illegally, it can become to be seen as 'normal' by society and therefore legalized de facto. For example "cruel and unusual punishment" does not outlaw the death penalty because it already exists and is sufficiently common to not count as unusual.
> the President and many Republicans routinely break laws in obvious manners
From a story about warrantless access to location data to... this comment.
First, warrantless access to XYZ is an issue with the criminal justice system, and I know you'll find people of all different political persuasions acting to keep that system in place and make prosecution as efficient as possible. It benefits them materially.
Second, the "Federal" government is overwhelmingly staffed by Democrats. In case you did not know, the Federal government is not just members of Congress. It includes the many departments of the Executive branch, and Trump can't just fire everyone and only hire Republicans. Scroll down here and look at what parties government workers donate to: https://www.fedsmith.com/2016/12/21/tallying-political-donat...
What level of involvement do you think those people have? Do you think the President or all of the Republican Senators are doing their jobs for them? What would it take to convince you that a Federal government is gonna do Federal government shit regardless of whether a D or R is in office?
>the President and many Republicans routinely break laws in obvious manners
Can you link to some citations regarding this? If one of our political parties and our elected officials are brazenly breaking the law I'd sure like to know about it!
I’m not sure a case is being made at all. A massive investigation turned up no criminal conspiracy and failed to substantiate a charge of obstruction. I’m really not sure what ‘spaceheretostay’ is on about.
> A massive investigation turned up no criminal conspiracy
That is definitely not true.
> failed to substantiate a charge of obstruction
This is also not true. The events are ongoing, the investigation has not 'failed' in any way.
> I’m really not sure what ‘spaceheretostay’ is on about.
I think I've made my points clearly. Abuses of power that are clearly illegal are common at the top of our government, and it happens because they openly commit crimes that they know will take years to investigate, during which times the goals of their illegal activities can be met. That is a direct example that directly relates to the parent comment in this thread.
Yeah he sounds very ideologically motivated and when pressed to backup his claims of crimes being committed completely failed to back them up. Seems par for the course for people to sling all sorts of accusations without backing them up these days, which is unfortunate because it's largely just toxic.
While I personally agree with the ruling, there's a good chance that it will get appealed (and potentially overturned), since US v. Carpenter, decided back in 2017, had a narrow holding.
The article mentions that the EFF:
> ...asked the court to recognize, as the Supreme Court did in U.S. v Carpenter, that people have a constitutional right to privacy in their physical movements.
But SCOTUSblog's reporting of that decision makes it clear that [1]:
> Roberts also left open the possibility that law-enforcement officials might not need a warrant to obtain cell-site location records for a shorter period of time than the seven days at issue in Carpenter’s case – which might allow them to get information about where someone was on the day of a crime, for example.
There are two dimensions involved: who's being tracked, and how long it's been tracked. In Carpenter's case, someone was tracked for 7 days without a warrant, while in Almonor, it was only 6 hours. Additionally, the EFF post suggests that this was a much more targeted search (one for specific suspects only) than the one in Carpenter.
As much as I dislike the idea of warrantless phone tracking, since Roberts crossed over to vote with the liberals on the side of a narrow majority on Carpenter, there's a decent chance this might get overturned on appeal.
It appears this ruling is based on the Massachusetts State Constitution, not the U.S. Constitution. States are allowed to have stronger protections against searches and seizures than what the 4th Amendment requires, and the U.S. Supreme Court (the only court above the MA Supreme Judicial Court) is unlikely to have the jurisdiction to interpret state constitutions.
> "Although the defendant raised both federal and state constitutional claims in Almonor, the court based its decision solely on Article 14 of the Massachusetts Declaration of Rights, which was drafted before—and served as one of the models for—our federal Bill of Rights. Article 14, one of the cornerstones of the Massachusetts Constitution, is the state’s equivalent to the Fourth Amendment. As the court notes, it 'does, or may, afford more substantive protection to individuals than that which prevails under the Constitution of the United States.'"
(From original article.)
> "the U.S. Supreme Court may hear appeals from state supreme courts only if there is a question of law under the United States Constitution (which includes issues arising from federal treaties, statutes, or regulations), and those appeals are heard at the Court's sole discretion (that is, only if the Court grants a petition for writ of certiorari)."
As well they should; it sounds objectively like an abuse of privacy. I don't much care for Google's Sensorvault DB [0] either but at least it's not (AIUI) real-time and completely unfettered. It'll be interesting to see if projects like that are considered unethical in a few years too along the same grounds.
Small victory bit a great first step. Searches by ANY agent of the government without a warrant, even of private data brokers, that is meant for prosecution should be illegal.
The ruling was based on the MA state constitution, so it probably doesn't constrain federal law enforcement agencies. But it definitely constrains MA state and local officials, whether or not they're collaborating voluntarily with the feds in a fusion center.
how hard is it really to get a warrant against someone? it seems like all it takes is to create reasonable doubt and you now have the “moral highground” to violate their personal rights
A law enforcement officer would first need to have probable cause, then create a sworn affidavit, then present this to a judge and if the judge agrees, a warrant is issued.
Search warrants are narrowly scoped. If they find evidence of other law breaking while executing the warrant, it's inadmissible in court. (unless they witness these crimes taking place)
They're only allowed to go after the crimes that they are already aware of.
That isn't really how it works. The search warrant must be narrowly scoped to only what is required to investigate the crime for which they have probable cause. However if they find evidence of other crimes while staying within the scope of the original warrant they can generally use that evidence at trial.
So for instance if the police have probable cause that a wanted criminal is at your house they can get a search warrant to search it for him. If while searching they see illegal drugs on your coffee table they can use that evidence under the plain view exception. However if they open up your schoolbag and find drugs they would not be able to use that as evidence because there is no way a person can fit inside your bag so searching it couldn't have been part of the search authorized by the warrant.
It sounds dystopian, but I'm not really sure I disagree with the government here. We allow our personal data (to include real time location) to be collected and sold on third party exchanges. I'm not sure there is a strong argument for the government needing a warrant to access the data given how freely we already disseminate it.
The solution would be to not disseminate it, but we, as a collective, have agreed to not make privacy a concern so far.
The biggest irony of all is, as we saw with gdpr, most hn users are nominally for privacy until regulation is implemented and we realize that we(most programmers) are the people making a living off of the current state of privacy.
It's interesting how textualism/originalism vs the constitution as a "living document" plays out. Of course a conservative interpretation of the constitution might say "the right to bear arms includes rocket launchers" where a liberal one might say "the founders could not have imagined such a weapon". In the same way, one could say "if you don't want to be tracked, don't carry a tracking device on you at all times", where a more liberal interpretation might be "the framers could not have imagined such an ubiquitous and useful device, and it's not reasonable to have to sacrifice modern convenience to maintain the privacy we thought we were guaranteed".
And depending on the issue at stake, a more liberal or more conservative view might give you greater rights.
I don't think that applies here. I'm specifically not saying that producing data makes it public. Rather I'm saying allowing a third party to resell your data with impunity necessarily obviates your ability to control the dissemination. If you've given control of your data to a third party, you have no control. Full stop.
If that were true, then wiretaps would be A-OK as long as 1) the phone company willingly plays along; and 2) the tap never physically intrudes upon the subject's property.
SCOTUS ruled explicitly on this question in Katz vs. US -- wiretapping is unconstitutional, regardless of physical intrusion. Just because you route your voice through a switch owned and controlled by a third part does not mean you give up your expectation of privacy.
In that case, you haven't entered into an agreement whereby advertisers may know the contents of your phone conversations in order to better target you with ads. If you had, I imagine SCOTUS would rule differently. It seems to me that this debate is merely about price. If the police were buying your location data off of a service that offered it, how would they be any different than advertisers?
That's not what is happening here. The police are not purchasing access like an advertiser would; they are receiving special access for the purpose of tracking suspects.
> If you had, I imagine SCOTUS would rule differently.
The SCOTUS of the 1960s was very clear -- routing your communication through a corporate party does not, in any way, negate your expectation of privacy from your own government!
SCOTUS has changed drastically since the 1960s, and I will be unsurprised if SCOTUS rolls back every single 'privacy' case that it encounters. But that has nothing to do with the merits of these cases; it's a way of salting the earth so that Roe v. Wade can be overturned while appearing less overtly political.
> That's not what is happening here. The police are not purchasing access like an advertiser would; they are receiving special access for the purpose of tracking suspects.
Yes, but my point was that we're only arguing about how much someone should have to spend to gain access.
> The SCOTUS of the 1960s was very clear -- routing your communication through a corporate party does not,
But my point, _again_, is that they were _not_ clear that you have some expectation of privacy after _selling your personal data on an exchange_.
I know what your point is. My point is that the courts have considered your point and don't agree... and for good reason. Your legal analysis basically amounts to "I don't like that other people use Google's services, and they deserve to suffer for their complacency".
> If you've given control of your data to a third party, you have no control. Full stop.
Given the current state of affairs, doesn't that effectively amount to not carrying a cell phone if you don't want to be tracked? It's not reasonable to assume that I opted in to sharing my data given that no realistic alternative is available to me.
I do see your point though - if third party exchanges dealing in such data are legal, then why can't the government use it? It does seem inconsistent.
I do agree that 'don't interact with the modern world' seems like a ridiculous solution.
Personally, I think GDPR was a reasonable first step down the path of regulation. I would personally like to see a regulation in the US that forced companies to offer data reselling as an add-on to a base package. As a programmer in 2019, I think it's a bit hypocritical of me to opt-in to the industry that is responsible for the situation we are in while saying 'regulation is the solution here'.
But it's important to note that we've moved from a legal to a moral question. Legally, I believe the government is currently in the right. Morally, the situation sucks and we should change it.
> As a programmer in 2019, I think it's a bit hypocritical of me to opt-in to the industry that is responsible for the situation we are in while saying 'regulation is the solution here'.
Ehh, it's not as though changing your profession would have any sort of meaningful influence on something as large and nebulous as data harvesting, aggregation, sale, and similar. Where would you even draw the line? I suspect you would have trouble finding a reasonably sized company to work for that doesn't engage with adtech or use some form of analytics in some way. Regulation is the only solution I can see here.
> As a programmer in 2019, I think it's a bit hypocritical of me to opt-in to the industry that is responsible for the situation we are in while saying 'regulation is the solution here'.
Unless you are responsible for the current situation then you aren't being hypocritical. I'm a programmer and only develop free software. I don't at all feel hypocritical to day that tech companies should be far more strictly regulated when it comes to user privacy and (god forbid!) ethics.
Yeah, posting your private personal information on a global communications network is a chump tier move. And if you don't realize that's what you're doing then you're even more of a chump.
isn't whether the founders could or could not have envisioned such a weapon somewhat of a moot point? the right to bear arms wasn't established simply because guns are a nice thing to have but as a means of ensuring that the government could be held in check by we the people. that doesn't work if the people are limited to flintlocks and the government has literally anything they can develop with practically unlimited scope. i don't really like guns at all, i find them loud and boring really but it's strange to frequently see people who argue that the spirit of the constitution must be interpreted further than the exact language only do so in a one sided manner that just so happens to align with their preexisting beliefs.
That's patently false. It's in that giant ToS that you didn't read and did sign. Here's where it is in T-Mobile's ToS [1].
You're looking for either,
"To identify and suggest products or services that might interest you;
To make internal business decisions about current and future product and service offerings;
To provide you customized user experiences, including personalized product and service offerings;"
or
"If your device is turned on, our network is collecting data about the device location. We may use, provide access to, or disclose this network location data without your approval to provide and support our services, including to route wireless communications, operate and improve our network and business,"
I think the bigger issue is that there are only 4 mobile networks and if none of them offer an option for privacy, then you're not really "choosing" anything since having access to the mobile network is integral to modern life.
I'm unsure if you're being disingenuous or legitimately don't understand the wording.
"To identify and suggest products or services that might interest you" -- means your data can be shared or sold to be used in advertising models.
"To provide you customized user experiences, including personalized product and service offerings;" -- same
"We may ... provide access to, or disclose ... location data without your approval to ... operate and improve ... our business," ellipses added so you can see it literally says we can give your data away for money.
i think the best possible workaround is to give people more power to decide when and how they choose to give up that information for convenience. the biggest irony is that the coming era of ubiquitous facial recognition & biometrics will probably render victories in regards to location tracking relatively moot.
MA generally holds state authority in the highest regards and likewise gives the cops tons of leeway to do whatever. That a judge in typically authoritarian state ruled to curtail police power is a pleasant surprise. I'm not complaining.
What a weird thing to say about Massachusetts. It has a constitution and an elected legislature, so it's definitely not an "authoritarian state". It has one of the lowest rates of police violence in the country, so I don't understand the quip about the cops either. Can you clarify?
>It has a constitution and an elected legislature, so it's definitely not an "authoritarian state"
I probably should have used the word "totalitarian". Yes, MA is a representative (some groups being much better represented than others) democracy. It still carries out the will of "the people" with an iron fist though. The people and government of MA basically worship government authority as though it is some inherent force of good in the world. When the government is doing something wrong the socially acceptable thing to do in MA is to bend over and take it. In other, less authoritarian, places it's socially acceptable to disobey the government or at least walk the line by complying with the letter instead of the intent. And by socially acceptable I mean that even the people working for the state will exercise discretion.
It's kind of hard to convey in an internet comment but the people of MA kind of treat the government like people used to treat the church 200yr ago. I got chastised by a couple of my coworkers for replacing my own damn water heater (one of the state's more asinine laws is that all plumbing requires a licensed plumber), not because "OMG, it could leak" but because I disobeyed the law. I find that kind of religious devotion to the authority of the state even when it is nonsensical to be very disagreeable.
>It has one of the lowest rates of police violence in the country
The cops are too busy meddling in matters of economic interest to them. Also it's a fairly left state and the police aren't idiots so they know they can't get away with rampant violence. It definitively could be worse. That doesn't mean the current situation is in any way satisfactory.
>I don't understand the quip about the cops either
The state police has tons of influence at all levels of government so the government given a choice between something that's good for the people vs good for the police will side with the police. The only time they typically don't is when the trade-off is between the government in general vs the police. MA judged are very much known for reading political pros and cons between the letters of the law. This is is a longstanding gripe many people have. That a MA judge read the law and interpreted it to deny power to the police is an unexpected outcome.
Damn straight I do. I know how that sausage is made. If I worked in a pepperoni factory I'd hate pepperoni. The only reason I don't go around shitting on things that seem bad about other states is because I don't have enough information to comment with a high enough confidence that I understand the big picture as well as the specifics.
That seems like precisely the information that should require a warrant, no?