Privacy’s “Third-party” Doctrine: Initial Developments in the Wake of Carpenter

The Third-Party Doctrine

At trial, Carpenter moved to suppress the CSLI data on Fourth Amendment grounds. The Fourth Amendment sets out:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.⁴

The government relied on a section of the Stored Communications Act, 18 U.S.C. § 2703(d), to obtain the court orders requiring production of the CSLI records. That statutory section only required a showing of “reasonable grounds” for believing that the records were “relevant and material to an ongoing investigation,” and as such was a lower standard than that required for a warrant. So, the government needed to show the search was “reasonable,” generally requiring a showing that it fit within one of the Supreme Court’s recognized exceptions to the warrant requirement. The trial court fit it under the business records exception, which is a subset of the third-party doctrine. United States v. Miller⁵ appears to be the seminal Supreme Court case recognizing a business records exception to the Fourth Amendment. In the case, the government had subpoenaed two banks for “all records of accounts, i.e., savings, checking, loan or otherwise, in the name of Mr. Mitch Miller.”⁶ The banks produced the documents ultimately leading to Miller’s conviction. Miller challenged the production as a violation of the Fourth Amendment. The Supreme Court held that “All of the documents obtained, including financial statements and deposit slips, contain only information voluntarily conveyed to the banks and exposed to their employees in the ordinary course of business.”⁷ The Court went on to state:

This Court has held repeatedly that the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.⁸

Thus, the government’s argument in Carpenter was that the CSLI that Carpenter’s phone sent to nearby cell towers, and ultimately back to his cell service provider, was voluntarily conveyed by him to the service providers and became part of their ordinary business records. While there is a logical consistency in this analogy, one wonders how many typical cell phone users actually even know their phones are constantly transmitting such information about their location, and if they don’t even know it is happening, how could it reasonably be characterized as voluntary?

Does Modern Technology Require a Fourth Amendment “Equilibrium Adjustment”?

Additionally muddying the waters were two earlier cases decided by the Supreme Court that suggested certain modern technologies were reducing the protections of the Fourth Amendment, and the Court was willing to engage in what some have termed “equilibrium adjustment”⁹ to reset the balance. Thus, in Riley v. California,¹⁰ the Supreme Court narrowed the scope of searches incident to arrest, a long-recognized exception to the Fourth Amendment’s general requirement of a warrant, when cell phones were involved. The Court noted:

Cell phones differ in both a quantitative and a qualitative sense from other objects that might be kept on an arrestee’s person. The term “cell phone” is itself misleading shorthand; many of these devices are in fact minicomputers that also happen to have the capacity to be used as a telephone. They could just as easily be called cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.¹¹

(In light of Carpenter, one might add to the above list personal tracking devices.) The qualitative and quantitative differences between cell phones and traditional physical evidence prompted the Court to exclude cell phones from the search incident to lawful arrest exception. It does not prevent law enforcement from searching a cell phone; they just must get a warrant.

So, too, in United States v. Jones,¹² the Supreme Court determined that the government’s employment of a modern technological device that would not have been envisioned by the Framers of the Constitution, in this case a Global Positioning System (GPS) tracking device, constituted a search that required a warrant. In Jones, the police had tracked a drug suspect’s vehicle using a GPS device for 28 consecutive days without a warrant, in order to link him to drug transactions. The government argued that attaching the GPS device to Jones’ vehicle and recording his travel on public streets was not a search or seizure as Jones could not reasonably expect privacy on public streets. If the search and seizure of such information did not constitute a search, then it necessarily did not require a warrant. The Supreme Court, however, held otherwise. The Court departed from its Katz¹³ analysis, which had been regularly applied to Fourth Amendment cases in the latter half of the 20th century, and which relied on a reasonable expectation of privacy test. Instead, the Court returned to an earlier line of cases tied to common law trespass. It held that the attachment of the GPS device to Jones’ vehicle constituted a search¹⁴ because it was a trespass on his private property “conjoined with … an attempt to find something or obtain information.”¹⁵ The Court even adopted an originalist¹⁶ analogy of a “tiny constable” “concealing himself in the target’s coach in order to track its movements.”¹⁷ Perhaps most importantly, a majority of the Court in Jones recognized that individuals “have a reasonable expectation of privacy in the whole of their physical movements.”¹⁸ But when did the tracking become a search? The Court side-stepped the issue, but the concurrence of Justice Alito and three other justices said, “We need not identify with precision the point at which the tracking of this vehicle became a search, for the line was surely crossed before the 4-week mark.”¹⁹

Justice Sotomayor’s concurring opinion in Jones further undermined the precedent of the third-party doctrine, stating, “This [third-party doctrine] approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”²⁰

With this background, the Court in Carpenter determined that the facts of the case fit at the intersection of the GPS cases (Jones and its predecessors) and the third-party cases (Miller and Smith²¹). That is, tracking a person through CSLI was similar to the GPS tracking in Jones, but it was also like Miller in that the tracking data were not the result of a tracker installed by the government but rather information voluntarily provided to a third party. Tying in Riley, the Court also recognized that the wealth of information provided by long-term tracking contravened the reasonable expectation of privacy Americans hold in such “privacies of life.”²²

The ability of law enforcement to track Carpenter’s movements over a protracted period of time (in his case 127 days) could be justified under prior precedent if done through the costly and labor-intensive technique of employing teams of law enforcement officers to surreptitiously follow the suspect day and night over public roads. In Carpenter, however, law enforcement was able to achieve largely the same end against virtually any member of the public by merely obtaining the person’s CSLI from the person’s cell provider. The government need not even identify the suspect in advance because it could retroactively obtain the full scope of movement of any later-identified suspect. While the former process would be likely to be approved only in the most serious of cases because of the cost and labor involved, the latter process was easy, simple, and virtually cost-free and could be applied retroactively to virtually anyone in the public.

The Court decided 5–4 in favor of Carpenter. The majority opinion declined to extend the third-party doctrine to CSLI data, holding it as qualitatively different,²³ giving the Government “near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.”²⁴ It held that the “Government’s acquisition of the cell-site records was a search within the meaning of the Fourth Amendment,” and, therefore, required a search warrant.²⁵

Decisions in the Wake of Carpenter

Since the decision issued in late June of 2018, there have been over 90 cases that have cited Carpenter. Many cases cite Carpenter for ancillary reasons, some even citing the dissenting opinions. Others distinguished the facts of their cases to hold Carpenter is not applicable. Most of those citing Carpenter for its holding that searches and seizures of CSLI data require a warrant have refused to suppress CSLI evidence or to overturn earlier decisions upholding the use of CSLI evidence on the basis of the good faith exception.²⁶ The good faith exception was established in United States v. Leon,²⁷ as an exception to the exclusionary rule.²⁸ The Court held it was inappropriate to exclude evidence under circumstances in which a law enforcement officer’s reliance on a magistrate’s determination of probable cause to issue a search warrant was objectively reasonable. The rationale was that the purpose of the exclusionary rule was to deter the police from engaging in unconstitutional conduct to obtain evidence. So, in cases where the police would not be deterred because they had relied on a search warrant later deemed to be invalid, exclusion would be inappropriate. Based on this rationale, the good faith exception has expanded to include a much broader scope of circumstances, including where the police relied on a statute that was subsequently declared unconstitutional.²⁹

In one post-Carpenter case, United States v. Thomas,³⁰ a court held the petitioner failed to raise the issue at the district court level and so refused to grant the petitioner relief. In another case, Florida v. Sylvestre,³¹ the appellate court concluded that the lower court found probable cause to issue the CSLI order and, therefore, was not in violation of Carpenter, even though the court’s order was pursuant to a statute that did not require a probable cause finding. Finally, in United States v. Oakes,³² the court held the defendant lacked standing because he claimed that he, “at no time in his life, has ever: (1) bought or owned T3; (2) knowingly possessed T3; (3) used T3; (4) controlled who used T3; (5) excluded others from using T3; or (6) authorized others to use T3.”³³ On that basis, the court held that the defendant had no standing to raise a Fourth Amendment claim relating to it, as the Carpenter decision clearly related only to a violation of privacy in one’s own phone. While that may be technically correct as to Carpenter, it fails to address the position of five justices in Jones that individuals have a reasonable expectation of privacy in the whole of their physical movements.³⁴ Clearly, Jones did not buy, own, control, or knowingly possess the government-installed tracking device on his automobile and the Court held it was a Fourth Amendment violation to track him for an extended period without a warrant. The bigger distinction in the cases appears to be that in Jones the police placed the tracking device on Jones’ vehicle, while in Oakes it was suggested that the victim or her agents planted it in Oakes’ vehicle and the police were able to knowingly or unknowingly leverage that.³⁵ That is surely an important distinction because the Fourth Amendment only proscribes government action, but the court in Oakes fails to directly address it.

Beyond the Court’s Narrow Holding

Ultimately, perhaps of more interest are the future cases the Supreme Court identified as not within the scope of its “narrow” decision in Carpenter. Notably, the Court stated:

We do not express a view on matters not before us: real-time CSLI or “tower dumps” (a download of information on all the devices that connected to a particular cell site during a particular interval). We do not disturb the application of Smith and Miller or call into question conventional surveillance techniques and tools, such as security cameras. Nor do we address other business records that might incidentally reveal location information. Further, our opinion does not consider other collection techniques involving foreign affairs or national security.³⁶

Stingrays

By “real-time CSLI” it appears the Court may have been referring to cell site simulators (sometimes referred to as Stingrays)³⁷ or International Mobile Subscriber Identity (IMSI) catchers.³⁸ These devices “masquerade as legitimate cell-phone towers, tricking phones within a certain radius into connecting to the device rather than a tower.”³⁹ By posing as the strongest cell site signal, nearby users’ phones are tricked into connecting with the Stingray instead of the phone company’s legitimate cell tower. When law enforcement employs such a device, it could allow law enforcement to obtain significant valuable information from the phone, including more accurate tracking of the user’s whereabouts over time.

The technology has become very popular among law enforcement and intelligence agencies, but rules regarding its use have varied. Significantly, however, the Department of Justice issued new guidance in 2015⁴⁰ requiring a warrant, except in rare situations primarily related to the exigent circumstances exception. Later that same year, the Department of Homeland Security issued similar guidance.⁴¹ “Several states, including California, Washington, Virginia, Utah, and Illinois have passed laws requiring law enforcement agencies to obtain a warrant before deploying cell-site simulators.”⁴² Thus, at least for now, legislators have addressed the issue left open by the Supreme Court in at least some of the most important jurisdictions.

Cell Tower Dumps

A cell tower dump is “a download of information on all the devices that connected to a particular cell site during a particular interval.”⁴³ Both Justice Kennedy and Justice Gorsuch in separate dissenting opinions criticize the majority’s exclusion of cell tower dumps from the scope of the Court’s holding. Justice Gorsuch asks:

Why isn’t a tower dump the paradigmatic example of “too permeating police surveillance” and a dangerous tool of “arbitrary” authority—the touchstones of the majority’s modified Katz analysis? On what possible basis could such mass data collection survive the Court’s test while collecting a single person’s data does not? Here again we are left to guess.⁴⁴

Thus, once again, while left open by the Court, prudent investigators would be well-advised to obtain a warrant for cell tower dumps.

Security Cameras

The circuits are currently split on whether the long-term use of security cameras violates the Fourth Amendment.⁴⁵ Security cameras can be used in a variety of ways, and some ways are less suspect to attack than others. However, technological improvements in security cameras and augmenting technologies pose perhaps the thorniest issues post-Carpenter. For example, video feeds from over 3,000 cameras can be combined with license plate readers and radiation detectors, as in New York City’s Domain Awareness System (DAS), to permit tracking “where a car associated with a suspect is located, and where it has been in past days, weeks or months.”⁴⁶ The DAS can also respond to reports of a suspicious package by looking back in time to identify who left the package and where the person went thereafter. Similar systems can support sophisticated camera handoffs to permit individualized tracking across camera gaps. These examples seem to raise the same concerns identified in Carpenter, regarding how long-term tracking not only of suspects but of all persons within a large area can contravene the reasonable expectation of privacy Americans hold in such “privacies of life.”⁴⁷ These technologies generally do not even involve the complication of the third-party doctrine because many of these systems are built and operated by the government. While observations in public areas are not normally accorded a reasonable expectation of privacy, the ease, simplicity, and cost-effective ways that such technologies can be applied retroactively to virtually anyone in the public may also argue for equilibrium adjustment. Facial recognition technologies, thermal imaging, and the leveraging of these capabilities through drones only exacerbate the privacy implications. Indeed, one court noted that “indiscriminate video surveillance raises the specter of the Orwellian state.”⁴⁸

Collection Techniques Involving Foreign Affairs or National Security

The Court’s exclusion of collection techniques involving foreign affairs or national security appears aimed at least partially at electronic collections under the Foreign Intelligence Surveillance Act (FISA),⁴⁹ especially a provision popularly known as Section 702, entitled “Procedures for targeting certain persons outside the United States other than United States persons.”⁵⁰ That provision has been used by the U.S. intelligence community to target the communications of non-U.S. persons located outside the United States for foreign intelligence purposes, but has been interpreted to permit the incidental collection of communications of any American who happens to communicate with foreign targets, sometimes referred to as the “incidental overhear rule.”⁵¹ The Carpenter Court chose not to tread into this complex issue, which was not raised by the facts of Carpenter, and could incidentally impact ongoing anti-terrorism investigations. The case law has not yet been well established because until 2013 only the FISA court could review activities taken under Section 702.⁵²

Conclusion

In sum, the Supreme Court’s Carpenter decision took an important step in defining how the use of CSLI was to be interpreted under the Fourth Amendment. The Court held that law enforcement’s use of such information without first obtaining a warrant was unconstitutional. Unfortunately, based on data from the two largest cell service providers, the volume of such past searches is estimated to be at least 250,000 unlawful CSLI searches per year, totaling more than four million since the passage of the USA PATRIOT Act in 2001. This is a staggering volume of constitutional violations, now beyond any possible remedy.⁵³

Yet the Court pointedly narrowed the scope of its decision and cited Justice Frankfurter for the proposition that “when considering new innovations …, the Court must tread carefully in such cases, to ensure that we do not ‘embarrass the future.’”⁵⁴ Fortunately the Court did not stick strictly to its doctrine of deciding only the case before it,⁵⁵ as the facts of Carpenter’s case arose in 2011, at a time when CSLI was far less accurate. Noting that in 2018, “the accuracy of CSLI is rapidly approaching GPS-level precision,” the Court took account of this more sophisticated technology in its decision. As it was, the Court’s decision came 13 years after the first magistrate ruled in a CSLI case seeking exactly such guidance:

[T]his opinion … is written in the full expectation and hope that the government will seek appropriate review by higher courts so that authoritative guidance will be given the magistrate judges who are called upon to rule on these applications on a daily basis.⁵⁶

Technology continues to evolve at an ever-faster pace. Hopefully the courts will be able to meet the challenge of applying the Fourth Amendment’s protections to these increasingly pervasive and invasive new technologies. 

Endnotes

1. No. 16-402, 138 S. Ct. 2206 (2018).

2. 18 U.S.C. §§ 2701–2712.

3. The facts of the case are drawn from the opinions of the Supreme Court, Carpenter, slip op. at 2–3, and the circuit court, United States v. Carpenter, 819 F.3d 880, 884–885 (2016).

4. U.S. Const. amend. IV.

5. Id., 425 U.S. 435 (1976).

6. Id. at 437.

7. Id. at 442.

8. Id. at 443 (citing United States v. White, 401 U. S. 745, 752 (1971); Hoffa v. United States, 385 U.S. 293, 302 (1966); Lopez v. United States, 373 U. S. 427 (1963)) (footnote omitted).

9. See, e.g., Orin Kerr, An Equilibrium-Adjustment Theory of the Fourth Amendment, 125 Harv. L. Rev. 476 (2011).

10. 573 U.S. 433 (2014).

11. Id. at 446.

12. 565 U.S. 400 (2012).

13. Katz v. United States, 389 U.S. 347 (1967).

14. Jones, at 404.

15. Id. at 408.

16. Originalism is “a legal philosophy that the words in documents and especially the U.S. Constitution should be interpreted as they were understood at the time they were written.” Merriam-Webster, https://www.merriam-webster.com/dictionary/originalism (last accessed Dec. 2, 2018).

17. Id. at 406 3.

18. Carpenter v. United States, No. 16-402, 138 S. Ct. 2206 (2018) (citing Jones, 565 U.S. at 430 (Alito, J., concurring); id. at 415 (Sotomayor, J., concurring)).

19. Jones, 565 U.S. at 430 (Alito, J., concurriing).

20. Id. at 417 (Sotomayor, J., concurring).

21. Smith v. Maryland, 442 U.S. 735 (1979) (holding that the petitioner had no reasonable expectation of privacy in his dialed telephone numbers obtained by law enforcement via a pen register/trap and trace order because he conveyed the numbers to the telephone company and the company recorded such information in its records).

22. Carpenter, No. 16-402, slip op. at 6 (citing Riley v. California, 573 U.S. 400, 452 (2014) (quoting Boyd v. United States, 116 U. S. 616, 630 (1886))).

23. Id. at 11.

24. Id. at 13. The Court conceded that the opinion was addressing where the technology was headed. The CSLI in this case was not as accurate as a GPS ankle monitor, but the Court averred that “CSLI is rapidly approaching GPS-level precision.” Id. at 14.

25. Id. at 17.

26. See, e.g., United States v. Zodhiates, 901 F.3d 137 (2d Cir. 2018); United States v. Chambers, No. 16-163-cr, (2d Cir., Sept. 21, 2018); United States v. Curtis, No. 17-1833 (7th Cir., Aug. 24, 2018); United States v. Shaw, No. 5:17-26-KKC (E.D. Ky., Aug. 3, 2018); United States v. Woods, No. 17-20022 (E.D. Mich., Aug. 28, 2018); United States v. Pleasant, No. 17-62, (E.D. Pa., Sept. 5, 2018); United States v. Boyle, No. 17-197 (E.D. Pa., Sept. 26, 2018); United States v. Leyva, No. 16-cr-20723 (E.D. Mich., Nov. 26, 2018).

27. 468 U.S. 897 (1984).

28. Mapp v. Ohio, 367 U.S. 643 (1961), established the exclusionary rule. It holds that evidence obtained in violation of the Fourth Amendment is generally not admissible at a criminal trial. The rule was later expanded to exclude evidence obtained in violation of the Fifth and Sixth Amendments. There are several exceptions to the rule.

29. Illinois v. Krull, 480 U.S. 340, 349 (1987).

30. 897 F.3d 807 (7th Cir. 2018).

31. No. 4D17-2116,(Fla. 4th D. Ct. App., Sept. 5, 2018).

32. No. 3:16-cr-00196 (M.D. Tenn., July 31, 2018).

33. Id. at 6.

34. See note 18, supra, and accompanying text.

35. Oakes, No. 3:16-cr-00196 at 6.

36. Carpenter v. United States, No. 16-402, slip. op at 17–18, 138 S. Ct. 2206 (2018).

37. StingRay is a particular model of a Harris Corporation cell site simulator, but the term has been genericized to refer generally to any cell site simulator. Other models include the TriggerFish, KingFish, and Hailstorm.

38. IMSI catchers are generally passive collectors, while cell site simulators are active collectors.

39. Elect. Freedom Found. website, https://www.eff.org/pages/cell-site-simulatorsimsi-catchers (last accessed Dec. 8, 2018).

40. U.S. Dep’t of Justice, Dep’t of Justice Policy Guidance: Use of Cell-Site Simulators (Sept. 3, 2015), https://www.justice.gov/opa/file/767321/download (last accessed Dec. 8, 2018).

41. U.S. Dep’t of Homeland Sec., Policy Directive 047-02, Department Policy Regarding the Use of Cell-Site Simulator Technology (Oct. 21, 2015), https://www.dhs.gov/sites/default/files/publications/Department%20Policy%20Regarding%20the%20Use%20of%20Cell-Site%20Simulator%20Technology.pdf.

42. Report of the House Comm. on Oversight & Gov’t Reform, Law Enforcement Use of Cell-Site Simulation Technologies: Privacy Concerns and Recommendations at 30 (footnotes omitted) (Dec. 19, 2016), https://oversight.house.gov/wp-content/uploads/2016/12/THE-FINAL-bipartisan-cell-site-simulator-report.pdf.

43. Carpenter v. United States, No. 16-402, slip. op at 17–18, 138 S. Ct. 2206 (2018).

44. Id. at 11 (Gorsuch, J., dissenting).

45. Compare, e.g., United States v. Cuevas-Sanchez, 821 F.2d 248 (5th Cir. 1987) (holding that a pole camera mounted to see into the defendant’s backyard over a 10-foot fence for two months was a Fourth Amendment search) with United States v. Houston, 813 F.3d 282 (6th Cir. 2016), reh’g en banc denied (2016) (holding that warrantless pole camera and surveillance of defendant’s trailer and private property for ten weeks did not violate Fourth Amendment); United States v. Bucci, 582 F.3d 108 (1st Cir. 2009) (holding that warrantless pole camera mounted across the street that monitored the defendant’s house for eight months did not violate Fourth Amendment); and United States v. Jackson, 213 F.3d 1269 (10th Cir. 2000) (holding warrantless pole camera mounted so as to view only what any passerby would see did not violate the Fourth Amendment).

46. Rebekah Morrison, New York’s Domain Awareness System: Every Citizen Under Surveillance, Coming to a City Near You, N.C. J. of L. & Tech. (citing an announcement by New York City Commissioner Ray Kelly in 2012), available at http://ncjolt.org/new-yorks-domain-awareness-system-every-citizen-under-surveillance-coming-to-a-city-near-you/ (last accessed Dec. 9, 2018).

47. See note 22, supra, and accompanying text.

48. United States v. Cuevas-Sanchez, 821 F.2d 248, 250–51 (5th Cir. 1987).

49. 50 U.S.C. § 1801 et seq.

50. Id. § 1881a.

51. Elizabeth Goitein, Another Bite Out of Katz: Foreign Intelligence Surveillance and the “Incidental Overhear” Doctrine, 55 Am. Crim. L. Rev. 105 (2018) available at https://www.law.georgetown.edu/american-criminal-law-review/wp-content/uploads/sites/15/2018/04/55-1-Another-Bite-out-of-Katz-Foreign-Intelligence-Surveillance-and-the-%E2%80%9CIncidental-Overhear%E2%80%9D-Doctrine.pdf.

52. Id. at 109–10.

53. Susan Freiwald & Stephen Wm. Smith, The Carpenter Chronicle: A Near-Perfect Surveillance, 132 Harv. L. Rev. 205, 232 (2018) (citing Kevin S. Bankston, Only the DOJ Knows: The Secret Law of Electronic Surveillance, 41 U.S.F. L. Rev. 589, 589–90 (2007)).

54. Carpenter v. United States, No. 16-402, slip. op at 17–18, 138 S. Ct. 2206 (2018) (citing Northwest Airlines, Inc. v. Minnesota, 322 U.S. 292, 300 (1944)).

55. Ironically, Chief Justice Roberts claimed the Court was deciding “no more than the case before us,” even after conceding the Court was not restricting itself to the technology actually used in Carpenter’s case. Id. at 18 n. 4.

56. In re Application for Pen Register & Trap/Trace Device with Cell Site Location Auth., 396 F. Supp. 2d 747, 765 (S.D. Tex. 2005).