For a shorter overview, please see EFF's one-pager handout, "Cell-Site Simulators: A Guide for Criminal Defense Attorneys."
- I. Questions to Ask in Discovery
- A. Discovery Request Template
- II. Ways to Challenge Warrantless CSS Use
- A. Fourth Amendment Protects Location Privacy
- B. Cell Phone Location Tracking Invades Individual Privacy
- C. Objective Expectation of Privacy in Location Information
- D. Americans' Subjective Expectation of Privacy in Location Information
- E. Congress and States Have Called for a Search Warrant for CSS Use
- F. DOJ Policy Requires a Search Warrant for CSS Use
- III. Ways to Challenge a CSS Search Warrant
- IV. Third Party Doctrine Doesn't Defeat a Reasonable Expectation of Privacy in Location Information
- What cell-site simulator make and model was used?
- What are its capabilities? What kind of information is it capable of intercepting?
- Ask for a copy of the instruction manual.
- What training was given to the CSS operator?
- What evidence is there that the CSS operator did/did not follow his/her/their training?
- What data, documents, reports were generated as part of the CSS deployment?
- How was the location information collected? And in what form?
- What are the GPS coordinates based on? How were they determined?
- Ask for the raw data, not just an inventory of the GPS coordinates and their date and time stamps
- How is this location information attributed to the cell phone of the client?
- Are the geographical coordinates of the cell phone or the cell tower?
- Ask for an inventory of the communications seized with the date, time, & location from the cell phone provider
- Ask for a map of the cell towers as they existed at the time of the data collection
- Does the agency own the equipment or did it borrow it from another agency?
- How did the prosecutor get this information? Was there a:
- Pen Register/Trap and Trace order?
- 2703(d) order?
- Search warrant?
- Any other order for GPS tracking?
For sample discovery request language refer to NYC Legal Aid’s CSS discovery request template.
II. Ways to Challenge Warrantless CSS Use
Warrantless searches of seven days or more of historical cell-site location information have been expressly rejected by the U.S. Supreme Court in Carpenter v. U.S., 585 U.S. ____, 138 S.Ct. 2206, 2217 (2018):
A person does not surrender all Fourth Amendment protection by venturing into the public sphere. To the contrary, “what [one] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.” Katz, 389 U.S. at 351–352. A majority of this Court has already recognized that individuals have a reasonable expectation of privacy in the whole of their physical movements. Jones, 565 U.S. at 430 [citations omitted].
But prior to the September 2015 policy change for the DOJ, DHS, and IRS, most CSS use was deployed without a warrant.
A. The Fourth Amendment Protects Location Privacy
“[A] Fourth Amendment search occurs when the government violates a subjective expectation of privacy that society recognizes as reasonable.” See Kyllo v. U.S., 533 U.S. 27, 33 (2001). The U.S. Supreme Court has recognized an individual's reasonable expectation of privacy, even when in public spaces, in cases like Katz (phone booth), Jones (car), and Carpenter (cell phone).
An individual maintains a legitimate expectation of privacy, for Fourth Amendment purposes, in the record of his physical movements as captured through cell site location information. Prior to the digital age, law enforcement might have pursued a suspect for a brief stretch, but doing so “for any extended period of time was difficult and costly and therefore rarely undertaken.” Jones at 429 (citations omitted). For that reason, “society's expectation has been that law enforcement agents and others would not—and indeed, in the main, simply could not—secretly monitor and catalogue every single movement of an individual's car for a very long period.” Id., at 430. Allowing government access to cell-site records contravenes that expectation. Although such records are generated for commercial purposes, that distinction does not negate Carpenter's anticipation of privacy in his physical location.
Carpenter, 138 S.Ct. at 2217.
Numerous opinion studies and advances in state law demonstrate both that Americans have a subjective expectation of privacy in their location information and that a growing portion of society recognizes this expectation as reasonable. Owning a cellphone is not a luxury; today more than 90% of all American adults have a cellphone, and these devices generate a staggering amount of data about when, where, and how often a phone’s user has traveled.
B. Cell Phone Location Tracking Invades Individual Privacy
Location information about where we go exposes intimate details about who we are. As with GPS information, the time-stamped data provides an intimate window into a person's life, revealing not only one's particular movements, but through them one's “familial, political, professional, religious, and sexual associations.” Carpenter at 2217 (citing U.S. v. Jones, 565 U.S. 400, 415 (2012).
The precision and accuracy of cellphone location capability is constantly increasing. In January 2015, the FCC adopted new rules to increase law enforcement’s ability to identify the location of callers when they are indoors, and require service providers to develop techniques to determine the altitude of a phone in order to reveal what floor it’s located on within a building.
C. Objective Expectation of Privacy in Location Information
Both courts and legislatures have come to recognize the privacy implications of location information. The U.S. Supreme Court has upheld an individual's reasonable expectation of privacy in their physical location in different contexts: such as the GPS coordinates of your car as in Jones or of your cell phone as in Carpenter.
While the Fourth Amendment is not “a redundant guarantee of whatever limits on search and seizure legislatures might have enacted,” Virginia v. Moore, 553 U.S. 164, 168 (2008), the existence of statutory protection for certain kinds of information helps inform whether society has determined that a particular expectation of privacy is reasonable. See, e.g., United States v. Maynard, 615 F.3d 544, 564 (D.C. Cir. 2010) (“state laws are indicative that prolonged GPS monitoring defeats an expectation of privacy that our society recognizes as reasonable”). A growing number of states protect location information by statute, including California, Minnesota, Virginia, Utah and Washington. And for a list of states that have considered or adopted some location privacy protections, take a look at the ACLU’s chart on the status of state privacy legislation that is current up to October 2015.
Courts’ and legislatures’ progress toward protecting cellphone location data from warrantless searches underlines the reasonableness of the privacy expectation in this information.
D. Americans’ Subjective Expectation of Privacy in Location Information
Americans believe the data generated by their cellphones are private. 82% of Americans consider the details of their physical location over time to be sensitive information. More than half of phone owners with mobile apps have uninstalled or decided not to install an app due to concerns about the privacy in their personal information. In addition, more than 30% of smart phone owners polled took affirmative steps to safeguard privacy: 19% turned off location tracking on their phones and 32% cleared their browsing or search history. The numbers are even higher for teenagers: 46% of teenagers turned off location services. 69% of American smart phone users did not like the idea of being tracked.
E. Congress and States Have Called for a Search Warrant Requirement for CSS Use
The U.S. Congressional House Oversight Committee released a stern report in 2015 calling on Congress to pass legislation requiring a warrant for CSS use. Several states have passed more privacy-protective laws requiring a warrant for CSS use, including: California, Minnesota, Virginia, Utah and Washington. And for a list of states that have considered or adopted some location privacy protections, see the ACLU’s chart on the status of state privacy legislation as of October 2015.
F. DOJ Policy Requires a Search Warrant for CSS Use
The DOJ’s CSS policy requires that a search warrant be obtained for CSS use in domestic criminal investigations. This policy also applies to any local or state agency that borrows CSS technology from the DOJ. While the policy doesn’t give defendants enforceable rights, it might still be persuasive to courts.
Even if law enforcement has obtained a search warrant, you should consider challenging the search warrant by raising the arguments we outline on our How to Challenge Digital Device Searches page, in the Ways to Challenge the Search section.
Also, review the DOJ's model CSS warrant and template warrant instructions to compare it with the search warrant in your case to see if there are any procedural missteps that you can flag as departures from the DOJ's guidelines.
Finally, rely on more privacy protective state law, where applicable.
The U.S. Supreme Court decided in Carpenter that the Third Party Doctrine does not defeat an individual’s reasonable expectation of privacy in cell phone location tracking data:
Given the unique nature of cell phone location records, the fact that the information is held by a third party does not by itself overcome the user's claim to Fourth Amendment protection. Whether the Government employs its own surveillance technology as in Jones or leverages the technology of a wireless carrier, we hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI. The location information obtained from Carpenter's wireless carriers was the product of a search. Carpenter at 2217.
Because location data derived from a cellphone is so much vaster in quantity and intrusive in quality than the limited data generated by a simple landline phone, courts cannot rely on cases that preceded the digital revolution to determine how to protect cellphone data. The laws governing antiquated analogs like those addressed in Smith v. Maryland, do not reflect the realities of modern society. We share much more information about ourselves with third parties merely as a byproduct of how we perform tasks today versus in the past.
In the U.S., 326-million people have 396-million cellphone accounts, and each of those cellphones regularly send signals that record the location and movement of its often-unwitting user. This seismic shift in technology would permit complete locational surveillance of the public, but as noted by Chief Justice Roberts: "we decline to grant the state unrestricted access to a wireless carrier's database of physical location information.” Carpenter, 585 U.S. at 22, 138 S.Ct. at 2223.