Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Threat Management, Threat Intelligence, Governance, Risk and Compliance, Compliance Management, Privacy, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Sixth Circuit appeals court: Feds don’t need warrant to collect cell location data

United States v Carpenter

A U.S. federal appeals court ruled on Wednesday that the Federal Bureau of Investigation (FBI) did not violate the Constitution when it collected cell site location information without a probable cause warrant, in order to track the movements of multiple robbery suspects.

In its 22-page judgment on United States v. Carpenter, the Sixth Circuit Court of Appeals in Cincinnati denied the appeal of convicted defendants Timothy Carpenter and Timothy Sanders, who argued that federal investigators deprived them of their Fourth Amendment rights against unreasonable search and seizure. The defense contended that evidence should have been suppressed during the criminal trial because the FBI relied on a mere court order, and not a warrant, to collect cell phone metadata from the two men's cellular carriers.

In his opinion, Judge Raymond Kethledge, one of three judges serving on the appellate panel, said that while the content of a phone call is inherently private, metadata such as cell tower site information is not. “The Supreme Court has long recognized a distinction between the content of a communication and the information necessary to convey it,” Kethledge wrote.

Court orders are easier to obtain than probable cause warrants because they require a lower threshold of evidence. The FBI originally obtained its court order from district magistrates who granted the agency's request pursuant to the Stored Communications Act, which allows the government to compel telecommunications companies to turn over customer data when specific facts prove such records would be relevant to an investigation. Ultimately, the records proved that the defendants were located within a half-mile to two miles of multiple Detroit-area robbery locations in 2011 at the specific time that the crimes occurred.

In justifying the decision, Kethledge said that looking at cell phone data is analogous to reading the outside of a mailed envelope or using a pen register device to track phone numbers that a person has dialed. In both cases, there is no reasonable expectation of privacy, the judge opined. “Although the content of personal communications is private, the information necessary to get those communications from point A to point B is not,” wrote Kethledge, adding that “courts have not (yet, at least) extended… protections to the Internet analogue to envelope markings, namely the metadata used to route Internet communications, like sender and recipient addresses on an email, or IP addresses.”

The defendants, as well as the American Civil Liberties Union (ACLU) in an amicus brief, had argued that the court should base its decision on the case United States v. Jones, in which a Supreme Court majority ruled that long-term GPS-based location tracking infringes on expectations of privacy. But Kethledge rejected the appellant's attempt to conflate cell tower data collection with GPS tracking data, which is far more precise than the former. Kethledge also dismissed comparisons to the Supreme Court case Riley v. California, in which the Supreme Court unanimously ruled that searching the contents of a cell phone without a warrant is unconstitutional.

However, the ruling does further muddy the waters around the specific issue of cell phone tower data tracking, which has already been addressed by several other federal courts, with mixed results.

For example, in the 2014 case United States v. Davis, the 11th Circuit Court of Appeals ruled that the collection of such metadata requires a court warrant. But the court subsequently reversed its own decision after applying the third-party doctrine, noting that it's the carrier that actually owns the data, not the cell phone user.

On the other hand, a split Fourth Circuit ruled in United States v. Graham that states that do require a warrant if the cell phone records cover “an extended period of time.”

The Fifth Circuit has also previously ruled that no warrant is needed, while the Third Circuit has ruled that judges have discretion over whether or not to require warrants under certain circumstances. Such discord among the federal courts could be setting the stage for a Supreme Court challenge down the road.

Even in the Carpenter case, a second judge, Jane Stranch, issued a concurrent opinion, expressing concern over the implications of warrantless data collection. “I believe that the sheer quantity of sensitive information procured without a warrant in this case raises Fourth Amendment concerns,” wrote Carpenter in her decision. Nevertheless, Stranch affirmed the court's judgment because, even if constitutional rights were violated, “some extension of the good-faith exception to the exclusionary rule would be appropriate.”

Nate Wessler, a staff attorney with the ACLU's Speech, Privacy and Technology Project, acknowledged in an to that courts around the country are grappling with complex, thorny digital privacy issues such as the one reflected here. “Unfortunately, a majority of judges in this case undervalued the importance of protecting cell phone location records from warrantless government access,” said Wessler, who filed the amicus brief in the case. “That leaves all of us at risk because there's really no way to go about our lives in modern society without using a cell phone without leaving digital breadcrumbs behind, revealing sensitive information about what you've been doing, where you've been.”

Carpenter's defense attorney Howard Gurewitz said in an interview with that he would petition the court for an en banc session to reconsider several aspects of the case, including the applicability of the good-faith exception. “The decision, I think, is a significant one because of the importance of the quickly evolving technology that is intersecting with the Fourth Amendment and the constitution. And it's our present intention to pursue this case further,” Gurewitz.

The U.S. Department of Justice, which argued the case on behalf of the U.S., did not respond to requests for comment.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.