As cell phones saturate the country, law enforcement agencies have routinely sought access to CSLI in criminal cases using either a 2703(d) order under the Stored Communications Act (18 USC 2701, et seq.) (a “D Order”), or a D Order in combination with a pen register/trap and trace order under the Pen Register and Trap and Trace Device Act (18 USC 3121, et seq.), rather than seeking a probable cause warrant. However, the U.S. Supreme Court decided that the Fourth Amendment requires the government to seek a probable cause warrant before obtaining seven days or more of historical CSLI in the landmark 2018 Carpenter decision.
EFF has long argued that the Fourth Amendment protects individuals’ expectation of privacy in CSLI, despite the third party doctrine, due to the incredibly intimate details it can reveal. Some states have enacted more privacy-protective state laws on locational privacy that require search warrants for both historical and prospective CSLI. Refer to the next section on How to Challenge law enforcement access to CSLI.
As the Supreme Court noted in Riley v. California, “three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting they even use their phones in the shower.” Accordingly, examination of historical CSLI over an extended period cannot be confined to public spaces and “will invariably enter constitutionally protected areas, such as private residences,” as one court put it. And as the Florida Supreme Court recognized in Tracey v. State, real time “cell phone tracking can easily invade the right to privacy in one’s home or other private areas, a matter that the government cannot always anticipate and one which, when it occurs, is clearly a Fourth Amendment violation.”
Yet the number of these requests is staggering. For example, AT&T alone received 70,528 requests for CSLI in 2016 and 76,340 requests in 2015. Verizon received 53,532 requests in 2016 and 50,066 requests in 2015. T-Mobile, the parent company of MetroPCS and the service provider in Carpenter does not report requests for CSLI specifically, but the company received far more requests for customer data as a whole than its much larger rivals. And the vast majority of these demands for CSLI prior to the Carpenter decision were warrantless. In 2016, Verizon reported that up to three-quarters of all law enforcement requests for historical and real-time location information were made via a court order rather than warrant.
Even where law enforcement has been prevailed upon to get a search warrant for CSLI, the assertion of probable cause is usually so thin, that it does not necessarily justify the search for this information. Most often, CSLI is obtained from a client’s cell phone as part of a general digital search warrant. For examples and strategies on how to challenge the digital search of your client’s device, go to our Digital Device Search page.
Even more troubling is that some law enforcement agencies seek location information without having a specific target subject in mind, and demand user location based solely on proximity to an incident under investigation. For example, Google was served with several search warrants from the Raleigh Police Department in North Carolina for location information of Google account users within a specified area that were approved by a judge without law enforcement having to identify a specific target or show that a potential suspect was even a Google account user:
- May 5, 2017 search warrant served to Google for an arson investigation.
- March 8, 2017 search warrant served to Google for a homicide investigation.
- March 7, 2017 search warrant for homicide investigation asking for information on devices within specified coordinates.
- April 7, 2017 search warrant for homicide investigation asking for information on devices within specified coordinates.
- October 27, 2017 search warrant for homicide investigation asking for information on devices within specified coordinates.
- July 29, 2016 search warrant for homicide investigation asking for information about individuals who made online searches for specific addresses.
While this is not generally the norm for CSLI search warrants, which are still few and far between, this kind of digital locational dragnet is precisely why judges must be vigilant in scrutinizing law enforcement’s proffers of probable cause and require sufficient particularity for access to location information.