Congress Should Place More Limits on Cellphone Location Tracking After Carpenter

This spring, the United States Supreme Court will issue a ruling in the landmark case of Carpenter v. United States, deciding whether the government requires a warrant to continuously track individuals’ location through their cellphones, a practice called cell site tracking.

In the (knock on wood, likely) event the court does rule that location tracking requires a warrant, Congress will need to step in to fill inevitable gaps in the law. A ruling on such a broad issue will probably contain ambiguities in application, necessitating legislation to offer clarity to law enforcement and courts. And even if the parameters of a warrant requirement are clear, there are numerous unresolved policy issues with cellphone tracking that the Supreme Court is unlikely to address.

With this in mind, below is an initial list of items Congress should address — in addition to a warrant requirement — as part of any legal scheme permitting tracking of Americans’ location via cellphone:

Standard exhaustion requirements: Given the sensitivity of location data, rules for gathering location data should not simply require a warrant. They need to be modeled after requirements in the Wiretap Act, which governs warrants for intercepting communications. An important component of these requirements is exhaustion (18 USC 2518(1)(c)): Investigators must demonstrate that less intrusive methods have already failed, or appear likely to. By including an exhaustion requirement, legislators could ensure such an invasive form of surveillance as cellphone tracking only occurs when necessary, rather than becoming a default procedure.

Electronic exhaustion: The traditional exhaustion requirement under the Wiretap Act states that investigators must first attempt “normal investigative procedures” that are less invasive. However, when dealing with cellphone location tracking, it is also critical to consider the wide range of electronic investigative procedures, and their varying impact on privacy. Legislation governing location tracking should include “electronic exhaustion,” and require that that less invasive electronic methods be attempted before more intrusive techniques are authorized.

This would have the greatest impact on law enforcement’s use of cell site simulators, commonly called stingrays. Unlike cell site tracking–the form of surveillance directly at issue in Carpenter–stingrays collect location data from a large group of people in a given area. “Electronic exhaustion” would limit this collateral damage to privacy by requiring that before the government uses a stingray, it must demonstrate that a narrower form of electronic location tracking that doesn’t affect non-targets (like cell site tracking) wouldn’t work. This would prevent overbroad surveillance such as “dirtboxes”–stingrays placed on planes to suck up location data from huge portions of entire cities–from being deployed in a cavalier manner.

Minimization rules and retention limits: For cases where stingrays or cell tower dumps are necessary (this can occur when a more precise location is needed, or for “reverse tracking” when a target’s location is known and the phone needs to be identified), a strict set of rules should require deletion of information for any individual’s data known to be irrelevant to an investigation, and general limits on the government’s retention of these data should also be in effect.

Such measures will be essential if location surveillance techniques that affect individuals en masse are applied at places relating to constitutionally-protected activities, such as at protests, political rallies, or religious ceremonies. Ensuring prompt destruction of unnecessary data will not only prevent abuse, it will also reassure individuals that their participation in sensitive activities won’t be recorded and stored by the government, which will stop location tracking from chilling First Amendment rights.

Transparency: For years, location tracking–especially with stingrays–was hidden from the public through extreme measures designed to preserve secrecy. Fortunately, advocacy efforts, especially by the ACLU, brought these controversial practices to light. Legislation should make sure such secrecy over location tracking never occurs again. A system for annual transparency reporting on all government requests for electronic location tracking, similar to the Wiretap Report, should be included. This reporting should break down location tracking requests in terms of historic versus prospective use, federal versus state requests, number of requested warrants accepted and rejected by courts, and should delineate the different methods employed (such as cell site tracking, stingrays, and tower dumps).

Exclusion:  Rigorous standards for location tracking will mean little if there are no consequences for violating the rules. All too often when law enforcement exceeds its legal authority on surveillance, it is still able to use the fruits of that improper surveillance as evidence in court. This problem will persist if there is any ambiguity in the Carpenter decision that could allow police to overstep lines while acting “in good faith.” The Wiretap Act provides strong exclusion rules (18 USC 2518(10)) that could form the foundation of similar rules that would mandate that improperly collected location data be excluded from use in court. Legislation in this area should set clear standards for excluding evidence–both direct and derivative–obtained through location surveillance that does not comply with legal limits.

Notification: In order to exercise privacy rights, it’s critical that defendants and any other individuals targeted for location tracking surveillance be notified so they can exercise their rights, and challenge any improper activity. Such rules are a standard aspect of communications surveillance (18 USC 2518(8)(d)), and could include a system for delays in notification to protect the integrity of ongoing investigations.

Carpenter may offer a critical leap forward for privacy, especially as new technologies implicate privacy-in-public in unprecedented ways. But even if a warrant requirement is established, secrecy and powerful tools such as stingrays create risks of overbroad surveillance. Local law enforcement should be focused on investigative targets, not attempting to enact former NSA Director Keith Alexander’s “Collect It All” philosophy at police departments across the nation. The reasonable legislative rules outlined above will help ensure proper limits, increase public awareness, and provide clear and consistent standards that will benefit law enforcement, civil liberties advocates, and the public alike.

Photo by Drew Angerer/Getty Images 

About the Author(s)

Jake Laperruque

Senior Counsel at Project on Government Oversight. Follow him on Twitter (@jakelaperruque). All views expressed in this piece are his own and do not represent those of his employer.