This Very Common Cellphone Surveillance Still Doesn't Require a Warrant

The government does not need a warrant to access the location data created on an ordinary, often minute-to-minute basis by cellphones and logged with cell providers, the Sixth Circuit for the U.S. Court of Appeals ruled Wednesday.

The ruling adds to a growing consensus among federal appeals courts that law enforcement can request this type of data—called “cell-site location information,” or CSLI—without violating the Fourth Amendment’s protection against unreasonable search or seizure. But it only complicates the legal situation of their use, which is now so complex that driving across the border from Illinois to Kentucky changes how federal authorities can use the technology.

Every time a cellphone checks in with its provider—to send a text message, to start or end a voice call, or just to get a push notification—it lodges a time-stamped piece of location information with the nearest cell tower. This data, CSLI, isn’t as precise as a GPS coordinate, but in urban or suburban areas it can narrow someone’s location down to less than two miles and give their angular relationship to the nearest cell tower. String a set of these time-stamped points together and you can disprove an alibi or reconstruct an escape route.

Right now, CSLI comes in three flavors. The first is “real-time,” where police work with a cell provider to access location data immediately after it’s created. This usually does require a warrant. The second is a “tower dump,” when authorities ask for all the phones that have communicated with a certain tower during a period of time. There’s not a lot of law about how tower dumps work, but as of September of last year cops rarely sought a warrant for them.  

The third is historical CSLI, where law enforcement requests a backlog of location data created by a certain phone. This does not require a warrant, and hundreds of these requests happen per day. In 2015, AT&T alone handled more than 58,000 requests for historic CSLI. (By contrast, it received about 17,000 real-time CSLI warrants and fewer than 1,500 tower-dump requests.) Warrantless CSLI may be the most common kind of cellphone surveillance that Americans are subject to.

The just-decided Sixth Circuit case, U.S. v. Carpenter and Sanders, is a good example of how this looks in practice. Between December 2010 and March 2011, there were a string of robberies of T-Mobile and Radioshack stores in and around Detroit. The robber, not named in the suit, confessed soon after the crimes and shared his cellphone number with the FBI. The agency requested his call records, then made a second request: the call records and cell-site location information for 16 additional phone numbers.

With this data, it identified the defendants in the suit—Timothy Sanders and Timothy Carpenter—as the alleged organizers, getaway car drivers, and lookout men for the robberies.

In making this critical second request, it asked for more than just a couple of days of location data. In fact, it asked for more than 215 days of combined CSLI, almost seven months of information total. The defendants and the American Civil Liberties Union contended that all this geographical data, when taken together, constituted a warrantless search.   

“When police obtain months’ worth of cellphone data comprising thousands of individual locations, like they did in this case, they should have to get a search warrant from a judge,” said Nathan Freed Wessler, the ACLU attorney who argued the case in front of the Sixth Circuit, in a statement.

The ACLU turned to two recent Supreme Court rulings for support. In the first, Riley v. California in 2014, the justices held that authorities couldn’t search a smartphone’s data without a warrant. In the second, U.S. v. Jones in 2012, they ruled that attaching a GPS tracker to a car without seeking a warrant first violated the Fourth Amendment.

The Sixth Circuit rejected the ACLU’s reasoning. Riley covered the wealth of internal data that a phone can store, including emails, notes, photos and text  messages; and not the limited kind of location data logged on corporate servers, wrote Judge Raymond Kethledge in the majority opinion. And the precise GPS tracking at issue in Jones, he said, doesn’t approach the general locational awareness permitted by CSLI.

Historical CSLI is “as much as 12,500 times less accurate than the GPS data in Jones,” wrote Kethledge. “And cellphone locational data are even less precise in suburban and rural settings [than urban ones]. Areas of this scale might encompass bridal stores and Bass Pro Shops, gay bars and straight ones, a Methodist church and the local mosque.”

Instead, Kethledge vindicates the federal privacy test that has been in effect since the late 1970s: the third-party doctrine, which holds Americans do not have a reasonable expectation of privacy to data created and logged by an outside corporation. This law differentiates between the private content of a communication and the information needed to convey it, and it’s why police need a warrant to wiretap a phone call but not to request call records.

But the Sixth Circuit’s ruling was not unanimous. While Judge Jane Stranch concurred with Kethledge’s decision, she disagreed that long-term historical CSLI was straightforwardly Constitutional. Fourth Amendment protection isn’t just a matter of precision, she said, approvingly citing a line from the Supreme Court’s 1942 decision in Skinner v. Oklahoma:

There may be situations where police, using otherwise legal methods, so comprehensively track a person’s activities that the very comprehensiveness of the tracking is unreasonable for Fourth Amendment purposes.

Stranch writes that CSLI sits uncomfortably between the law governing location information and the law governing business records.

“I do not think that treating the CSLI obtained as a ‘business record’ and applying that test addresses our circuit’s stated concern regarding long-term, comprehensive tracking of an individual’s location without a warrant,” she writes. Ultimately, she writes, the Sixth Circuit or a higher court may need to develop a new legal test to determine exactly what kinds of search require a warrant.

The day when the Supreme Court formulates that test, however, may now not come for years. In upholding the constitutionality of warrantless CSLI requests, the Sixth Circuit joins two other federal appeals courts, the Fifth and the Eleventh Circuit. All three courts have now ruled that seeking months of historical cell-site data without a warrant is perfectly legal.

As recently as last year, that looked like it might change. Last summer, the Fourth Circuit ruled that this kind of warrantless CSLI request was illegal. The ACLU also asked the Supreme Court to take up a case on the same question. But the high court declined the petition, and, in October, the Fourth Circuit decided to rehear the CSLI case again as a full court. This vacates its earlier ruling and removes the brief circuit split.

So the legal status of warrantless cellphone tracking remains messy: a drive up Interstate 95 would take you through states where a warrant is required for all CSLI, for just historical CSLI, for some historical CSLI—and where no warrant is required at all. The ACLU has created a map of what protections exist in each state. I’ve embedded it below. There’s a good chance that it will get even more complicated before it starts to improve: