Subject: [ietf-privacy] Fwd: [Internet Policy] How a Radio Shack Robbery Could Spur a New Era in Digital Privacy

From: Fred Baker <[email-masked]>
Date: Mon, 27 Nov 2017 11:35:23 -0800

Interesting article, cross-posted from ISOC Public Policy list

> Begin forwarded message:
> 
> From: "Richard Hill" <[email-masked]>
> Subject: [Internet Policy] How a Radio Shack Robbery Could Spur a New Era in Digital Privacy
> Date: November 27, 2017 at 3:15:08 AM PST
> To: "Internetpolicy@Elists. Isoc. Org" <[email-masked]>
> 
> FYI,
> 
> Best,
> 
> Richard
> 
> ================
> 
> How a Radio Shack Robbery Could Spur a New Era in Digital Privacy
> 
> By ADAM LIPTAK <https://www.nytimes.com/by/adam-liptak> NOV. 27, 2017
> 
> Photo
> 
> 
> 
> A Supreme Court decision expected by June will shape how the privacy protections of the Fourth Amendment, drafted in the 18th century, apply to a world in which people’s movements are continuously recorded by devices. Credit J. Scott Applewhite/Associated Press
> 
> WASHINGTON — The case that could transform privacy law in the digital era began with the armed robbery of a Radio Shack store in Detroit, a couple of weeks before Christmas in 2010. In the next three months, eight more stores in Michigan and Ohio were robbed at gunpoint.
> 
> The robbers took bags filled with smartphones. Their own phones would help send them to prison.
> 
> On Wednesday, the Supreme Court will consider whether prosecutors violated the Fourth Amendment <https://www.law.cornell.edu/constitution/fourth_amendment>, which bars unreasonable searches, by collecting vast amounts of data from cellphone companies showing the movements of the man they say organized most of the robberies.
> 
> Experts in privacy law said the case, Carpenter v. United States, No. 16-402, was a potential blockbuster.
> 
> “Carpenter could be the most important electronic privacy case of the 21st century,” said Jeffrey Rosen <https://constitutioncenter.org/press-room/expert-sources/jeffrey-rosen>, the president of the National Constitution Center, a nonprofit group devoted to educating the public about the Constitution.
> 
> In a pair of recent decisions, the Supreme Court expressed discomfort with allowing unlimited government access to digital data. It limited the ability of the police to use GPS devices to track suspects’ movements, and it required a warrant to search cellphones.
> 
> Technology companies including Apple, Facebook and Google have filed a brief <http://www.scotusblog.com/wp-content/uploads/2017/08/16-402-ac-technology-companies.pdf> urging the Supreme Court to continue to bring Fourth Amendment law into the modern era. “No constitutional doctrine should presume,” the brief said, “that consumers assume the risk of warrantless government surveillance simply by using technologies that are beneficial and increasingly integrated into modern life.”
> 
> The court’s decision, expected by June, will apply the Fourth Amendment, drafted in the 18th century, to a world in which people’s movements are continuously recorded by devices in their cars, pockets and purses, by toll plazas and by transit systems. The court’s reasoning may also apply to email and text messages, internet searches, and bank and credit card records.
> 
> “The case is hugely important in that it defines the constitutional role in a really wide range of cases,” said Orin Kerr <http://gould.usc.edu/faculty/?id=73523>, a law professor who will soon join the faculty at the University of Southern California.
> 
> The case concerns Timothy Ivory Carpenter, who witnesses said had planned the robberies, supplied guns and served as lookout, typically waiting in a stolen car across the street. “At his signal, the robbers entered the store, brandished their guns, herded customers and employees to the back, and ordered the employees to fill the robbers’ bags with new smartphones,” a court decision said <http://www.scotusblog.com/wp-content/uploads/2016/10/16-402-op-bel-6th-cir.pdf>, summarizing the evidence against him.
> 
> In addition to presenting testimony, prosecutors relied on months of records obtained from cellphone companies to prove their case. The records showed that Mr. Carpenter’s phone had been nearby when several of the robberies happened. He was convicted and sentenced to 116 years in prison.
> 
> Mr. Carpenter’s lawyers said cellphone companies had turned over 127 days of records that placed his phone at 12,898 locations, based on information from cellphone towers. Prosecutors could tell whether he had slept at home on given nights and whether he attended his usual church on Sunday mornings.
> 
> “Never before in the history of policing has the government had the time machine it has here,” said Nathan Freed Wessler <https://www.aclu.org/bio/nathan-freed-wessler>, a lawyer with the American Civil Liberties Union, which represents Mr. Carpenter. Mr. Wessler said prosecutors should be required to obtain a warrant when they seek more than 24 hours’ worth of location data.
> 
> Older Supreme Court decisions indicate that no warrant was required. In 1979, for instance, in Smith v. Maryland <http://caselaw.lp.findlaw.com/scripts/getcase.pl?court=US&invol=735&vol=442>, the Supreme Court ruled that a robbery suspect had no reasonable expectation that his right to privacy extended to the numbers dialed from his landline phone. The court reasoned that the suspect had voluntarily turned over that information to a third party: the phone company.
> 
> Relying on the Smith decision’s “third-party doctrine,” federal appeals courts have said government investigators seeking data from cellphone companies showing users’ movements also do not require a warrant.
> 
> A federal law, the Stored Communications Act <https://www.law.cornell.edu/uscode/text/18/2703>, does require prosecutors to go to court to obtain tracking data, but the showing they must make under the law is not probable cause, the standard for a warrant. Instead, they must demonstrate only that there were “specific and articulable facts showing that there are reasonable grounds to believe” that the records sought “are relevant and material to an ongoing criminal investigation.”
> 
> Professor Kerr said Congress was better suited than the courts to strike the right balance between the government’s need for information and privacy rights. In Mr. Carpenter’s case, he added, the Fourth Amendment should not apply because there was no search.
> 
> Mr. Carpenter’s lawyers rely on two recent and unanimous Supreme Court decisions expressing discomfort with the collection of large amounts of digital data. In 2014, in Riley v. California <https://www.nytimes.com/2014/06/26/us/supreme-court-cellphones-search-privacy.html?_r=0>, the court said the police must generally have a warrant to search the cellphones of people they arrest.
> 
> “Modern cellphones are not just another technological convenience,” Chief Justice John G. Roberts Jr. wrote for the court. Even the word cellphone is a misnomer, he said. “They could just as easily be called cameras, video players, Rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps or newspapers,” the chief justice wrote.
> 
> But the Riley case concerned information possessed by the person arrested. Mr. Carpenter’s case concerns information held by cellphone companies.
> 
> The second case, United States v. Jones <http://www.nytimes.com/2012/01/24/us/police-use-of-gps-is-ruled-unconstitutional.html>, in 2012, concerned a GPS device that the police attached to a suspect’s car, allowing them to track his movements for 28 days.
> 
> All nine justices agreed that this was problematic under the Fourth Amendment, but they were divided on the rationale for the decision. The majority said the police were not entitled to place the device on private property. But five justices in concurring opinions expressed unease with the government’s ability to vacuum up troves of private information.
> 
> “The use of longer-term GPS monitoring in investigations of most offenses impinges on expectations of privacy,” Justice Samuel A. Alito Jr. wrote for four justices. “Society’s expectation has been that law enforcement agents and others would not — and indeed, in the main, simply could not — secretly monitor and catalog every single movement of an individual’s car for a very long period.”
> 
> Cellphone tower information is not nearly as accurate as that generated by GPS devices, but it is catching up.
> 
> Mr. Rosen, who favors broad privacy protections, said Mr. Carpenter’s case could transform Fourth Amendment law however the court rules.
> 
> “If the court squarely recognizes what it’s been suggesting in recent cases, namely that we do have an expectation of privacy in our digital data and public movements and that the Fourth Amendment prohibits the government from tracking us door to door for weeks in public, that would be an occasion for dancing in the streets,” he said. “If the court holds that we don’t have an expectation of privacy in public except when there is some sort of physical trespass involved, that could be a huge setback for privacy.”
> 
> nyt
> 
> _______________________________________________
> To manage your ISOC subscriptions or unsubscribe,
> please log into the ISOC Member Portal:
> https://portal.isoc.org/ <https://portal.isoc.org/>
> Then choose Interests & Subscriptions from the My Account menu.

---

From: "John Levine" <[email-masked]>
Date: 27 Nov 2017 20:41:33 -0000

>Interesting article, cross-posted from ISOC Public Policy list

Carpenter is an interesting case, but it has nothing to do with the
Internet.

It's quite fact specific to mobile phones, which by their nature
transmit a running history of their location to the towers which
mobile phone companies log.  This was true even in AMPS days, at least
the tower data part if not the logging.

The question presented is whether the cops need a warrant from a judge
to get access to those logs or just a subpoena from law enforcement or
from a lawyer.  The argument on one side is that it's a great deal of
rather personal information, e.g., it told them whether Carpenter went
to church each Sunday and when he spent the night at someone's house
other than his own.  The argument on the other is that it's the same
info they'd get if they had a cop tail the guy.  (You don't have to
tell me that those arguments are not equally persuasive, but that's
what they are.)

Lots of details here:

http://www.scotusblog.com/case-files/cases/carpenter-v-united-states-2

Here's the usually reasonable Orin Kerr making the just like a tail argument:

http://www.scotusblog.com/2017/08/symposium-carpenter-eyewitness-rule/

R's,
John

---

From: Ted Hardie <[email-masked]>
Date: Mon, 27 Nov 2017 12:53:01 -0800

> http://www.scotusblog.com/case-files/cases/carpenter-v-united-states-2
http://www.scotusblog.com/2017/08/symposium-millions-tiny-constables-time-set-record-straight-fourth-amendment-location-data-privacy/

is the link from within that set that I think identifies the right
precedent quickest.  Given the judgement that adding a GPS device was a
"tiny constable", I don't see how getting the data from an existing GPS
device won't be judged by the same standard.

Of course, the make up of the court has changed.  We'll see if that shifts
things, I guess.

Ted

> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>

---

From: Wendy Seltzer <[email-masked]>
Date: Mon, 27 Nov 2017 15:54:40 -0500

> Carpenter is an interesting case, but it has nothing to do with the

The case itself is unrelated to the Internet, but precedent it sets
regarding the continued viability of or limits on the "third party
doctrine" -- the doctrine that because the individual gave data to a
third party, law enforcement can request it from that third party rather
without a warrant -- could carry over to Internet tracking.

--Wendy

-- 
Wendy Seltzer -- [email-masked] +1 617.863.0613
Strategy Lead, World Wide Web Consortium (W3C)
Berkman Klein Center for Internet & Society at Harvard University
https://wendy.seltzer.org/
https://www.lumendatabase.org/
https://www.torproject.org/

---

From: [email-masked]
Date: Mon, 27 Nov 2017 22:40:06 +0000

Hiya, 

> Interesting article, cross-posted from ISOC Public Policy list

I'm not sure it's that interesting, but regardless of that the article is v. US centric and I'm fairly sure such traditional nationalisms are less important than previously. 

S.

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 28 Nov 2017 17:51:26 +1100

Interesting, when looked at through the lens of the e2e crypto debate:

> The second kind of case considered when disclosure from inside a protected space eliminated privacy. The Supreme Court decided a long string of those cases in the decade before Katz. And it consistently adopted a simple rule: A person who knowingly exposed private information from a private space to outside observation waived Fourth Amendment protection.

[...]

> First, a space had to be protected, which was the case if society was willing to recognize an expectation of privacy as reasonable there. Second, the person had to “exhibit” an actual expectation of privacy, an intention “to keep” the protected space “to himself,” by not exposing the space “to the plain view of outsiders.”

So, it seems like (IANAL) one way to read the situation is that the government is currently trying to get companies to forcefully take the expectation of privacy off the table for commonly used communication tools.

I wonder what the analysis is WRT back doors vs. "keep the plaintext" (what they currently seem to be pursuing). The latter seems to sidestep the second test above...

(Of course, I'm just a bystander here, and could be very wrong, but would be interested to understand why)

--
Mark Nottingham   https://www.mnot.net/

---

From: "John Levine" <[email-masked]>
Date: 28 Nov 2017 16:17:35 -0000

In article <[email-masked]> you write:
>So, it seems like (IANAL) one way to read the situation is that the government is currently trying to
>get companies to forcefully take the expectation of privacy off the table for commonly used
>communication tools.

I don't think that's the issue here.  The telcos have files full of
plaintext location information.  The question is who can look at them.

>I wonder what the analysis is WRT back doors vs. "keep the plaintext" (what they currently seem to be
>pursuing). The latter seems to sidestep the second test above...

That's a whole different can of worms. Access to the contents of
conversations has always required a warrant, and certain parts of law
enforcement believe that they have the right to force everyone else to
provide those contents in plaintext, regardless of what the laws of
mathematics might say.

R's,
John