The top of a cell phone tower. 
Getty Images
Americans may have a Florida drug dealer to thank for expanding our right to privacy.
Police departments around the country have been collecting phone metadata from telecoms and using a sophisticated spy tool to track people through their mobile phones—often without obtaining a warrant. But a new ruling out of Florida has curbed the activity in that state, on constitutional grounds. It raises hope among civil liberties advocates that other jurisdictions around the country may follow suit.
The Florida Supreme Court ruled Thursday that obtaining cell phone location data to track a person’s location or movement in real time constitutes a Fourth Amendment search and therefore requires a court-ordered warrant.
The case specifically involves cell tower data for a convicted drug dealer that police obtained from a telecom without a warrant. But the way the ruling is written (.pdf), it would also cover the use of so-called “stingrays”—sophisticated technology law enforcement agencies use to locate and track people in the field without assistance from telecoms. Agencies around the country, including in Florida, have been using the technology to track suspects—sometimes without obtaining a court order, other times deliberately deceiving judges and defendants about their use of the devices to track suspects, telling judges the information came from “confidential” sources rather than disclose their use of stingrays. The new ruling would require them to obtain a warrant or stop using the devices.
The American Civil Liberties Union calls the Florida ruling “a resounding defense” of the public’s right to privacy.
“Following people’s movements by secretly turning their cell phones into tracking devices can reveal extremely sensitive details of our lives, like where we go to the doctor or psychiatrist, where we spend the night, and who our friends are,” said Nate Freed Wessler, an attorney with the ACLU’s Speech, Privacy and Technology Project. “Police are now on notice that they need to get a warrant from a judge before tracking cell phones, whether using information from the service provider or their own ‘Stingray’ cell phone tracking equipment.”
The ruling constitutes the first time that a state court has reached this finding under the Fourth Amendment. It comes at a timely moment when federal courts of appeal in other jurisdictions are in the midst of taking up the question of cell tower data, Wessler told WIRED. Even if other jurisdictions rule differently, the Florida case makes it more likely that the issue will one day get to the U.S. Supreme Court. If it does, civil liberties advocates hope that the federal court would rule as it did on the use of GPS tracking devices used by police, determining that it constitutes a search under the Fourth Amendment. Though the court in that case fell short of ruling that the use of GPS devices requires a warrant, law enforcement agencies around the country have changed their practices as a result of the ruling.
The American Civil Liberties Union calls the Florida ruling “a resounding defense” of the public’s right to privacy.
Stingrays are equally as invasive as GPS trackers, if not more so since GPS trackers are generally used on vehicles traveling public roads. Stingrays, however, can track the mobile phone wherever it goes—inside an apartment building and even down to the exact apartment where a person resides.
The stingrays, also known as IMSI catchers, simulate a cellphone tower and trick any nearby mobile devices into connecting with them, thereby revealing their location. When mobile phones connect to the stingray, the device can see and record their unique ID numbers and traffic data, as well as information that points to the phone’s location. By moving the stingray around, authorities can triangulate the phone’s location with greater precision than they can using data obtained from a fixed tower location and from telecoms.
The Justice Department has long asserted that law enforcement agencies don’t need a probable-cause warrant to use stingrays because they don’t collect the content of phone calls and text messages. Instead, authorities say, they operate like pen-register and trap-and-trace systems, collecting the equivalent of header information. A pen register system records the phone numbers that a person dials, while a trap-and-trace system records the phone numbers of incoming calls to that phone.
The ACLU and others argue, however, that stingrays are more invasive than a trap-and-trace and should require a warrant. By not seeking a warrant to use them, police in Florida have been able to not only conceal from judges and defendant’s their use of the devices but also prevent the public from learning how the secretive technology is employed.
With regard to the Florida drug case—involving cell tower data obtained from a telecom—the ruling is significant for another reason in that the court rejected arguments that a user has no expectation of privacy in data collected by a telecom.
The government argued in the case that they had a right to obtain the data without a warrant because it carried no special protection under the so-called third-party doctrine. Under this argument the government asserts that information a person provides to a third-party—in this case the telecom—carries no expectation of privacy. When a mobile user’s phone pings nearby cell towers, the user is willingly providing the cell tower, and telecom, with their location information, the government argued.
But the judges rejected this argument out of hand.
“Simply because the cell phone user knows or should know that his cell phone gives off signals that enable the service provider to detect its location for call routing purposes, and which enable cell phone applications to operate for navigation, weather reporting, and other purposes, does not mean that the user is consenting to use of that location information by third parties for any other unrelated purposes,” the judges wrote. “While a person may voluntarily convey personal information to a business or other entity for personal purposes, such disclosure cannot reasonably be considered to be disclosure for all purposes to third parties not involved in that transaction.”
The drug dealer in question, essentially, did not consent to give his location to police just by possessing and using a cell phone.
