The U.S. Supreme Court on Friday ruled that data generated by mobile devices - including mobile phones - that can be used to track individuals is protected by the Fourth Amendment, which guards against unreasonable search and seizure.
See Also: Matching Application Security to Business Needs
The long-awaited ruling in the case of Carpenter v. U.S. was decided by a margin of 5-4, with all of the justices who joined the majority issuing a single opinion.
The case involves Timothy Carpenter, who was convicted of a string of burglaries in Detroit in 2013. "To tie Carpenter to the burglaries, FBI agents obtained - without seeking a warrant - months' worth of his location information from Carpenter's cellphone company," says Nathan Freed Wessler, an American Civil Liberties Union staff attorney who argued the case before the Supreme Court last November. "They got almost 13,000 data points tracking Carpenter's whereabouts during that period, revealing where he slept, when he attended church and much more."
On Friday, the Supreme Court ruled that Wessler's Fourth Amendment rights had been violated.
"When the government tracks the location of a cell phone, it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone's user," Chief Justice John Roberts, who authored the majority opinion in the case, wrote in the Friday decision.
Justice Samuel Alito, who wrote one of four dissenting opinions, however, worried that the ruling "guarantees a blizzard of litigation while threatening many legitimate and valuable investigative practices upon which law enforcement has rightfully come to rely."
Ruling Replaces 1970s-Era Legal Theory
Digital rights groups say the ruling is a watershed for individuals' privacy rights in the modern age.
The ruling "provides a groundbreaking update to privacy rights that the digital age has rendered vulnerable to abuse by the government's appetite for surveillance," says the ACLU's Wessler.
The case serves as "a crack in the edifice" of the "third-party doctrine," says Andrew Crocker, a staff attorney at the Electronic Frontier Foundation, a digital rights group.
"For decades, the case law in the U.S. has held that persons who voluntarily share information with a third party have no expectation of privacy in that underlying information," says attorney Chris Pierson, head of cybersecurity consultancy Binary Sun Cyber Risk Advisers.
Under existing case law, that applied to all telephone - including mobile phone - metadata. "When a person dials a phone number, they are voluntarily giving the phone company and numerous intermediaries their own phone number, the number being called, and time and date information relating to that call," Pierson said.
As a result, in an investigation, police only needed to obtain a subpoena or court order, rather than a search warrant - which is more difficult to obtain - to access an individual's telephone records or bank records.
"All that was required by the government was a showing of 'reasonable grounds' for a court order to access the records - something that is quite a low bar in terms of privacy and search protections," Pierson said.
As some recent incidents have highlighted, however, it's not clear that organizations that amassed or shared mobile-phone location tracking information were even requiring law enforcement users to prove that they had obtained a subpoena or court order that allowed them to access such data (see Real-Time Mobile Phone Location Tracking: Questions Mount).
Police Must Demonstrate 'Probably Cause'
Now, however, the Supreme Court's ruling has raised the bar for accessing such data, at least in many cases.
"There is a world of difference between the limited types of personal information addressed" by the 1970s legal theory on which the government has been operating, "and the exhaustive chronicle of location information casually collected by wireless carriers today," the majority decision reads.
Back then, "few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person's movements."
As a result, the Supreme Court's ruling means that when police want access to this data, they must first prove that they need it.
"What the Supreme Court in Carpenter v U.S. held is that generally the government - i.e. law enforcement - must get a warrant before obtaining cell phone transactional records (tower location information)," Pierson tells Information Security Media Group. "This means the government must show under a 'probable cause' threshold of inquiry and proof that a warrant is needed to access the cell-site location information (CSLI)."
In other words, police in many cases must now "procure more information and data to support such a warrant ... and as a result persons will have a greater degree of privacy in their location despite carrying devices that are constantly beaconing to cell-towers," Pierson says.
The ruling does not apply in all cases, Pierson says; the government can still request exceptional access - without a warrant - in some situations, such as kidnapping cases.
Court Performs an 'Equilibrium Adjustment'
Legal analysts say the case appears to show the Supreme Court shifting its stance on individuals' privacy rights and what constitutes reasonable access to information that can be used to track individuals, including their historic activities.
"Although this case is very specific to cell-site location information, we can see that the court is moving pendulum back towards individual privacy, despite technological advances," Pierson says.
Computer crime law expert Orin Kerr, who teaches at the University of Southern California Gould School of Law, writes in Lawfare that the ruling shows the court engaging in an "equilibrium adjustment" as it weighs the how new technology could potentially be abused by the government.
"Throughout the opinion, [Roberts] roots his analysis in the idea that cell-site surveillance is a new tool that gives the government new power that can be abused, and that the law must change course to ensure that the government doesn't get too much power from a mechanical application of the old rules," Kerr says.
The ACLU's Wessler says the ruling recognizes that cell phones and the services they provide are "such a pervasive and insistent part of daily life" that carrying one is indispensable to participation in modern society. And it helps ensure that we don't have to give up those rights if we want to participate in modern life."