Seeing a history of all your movements is now easier for you, but harder for the feds

By Kashmir Hill | August 5, 2015 | 8:05pm

Latest

When you meet a new someone who makes your heart flutter and the feeling is mutual, and the two of you have spent significant parts of your life in the same city at the same time, there is usually a conversation within the first few weeks of the relationship trying to figure out why you didn’t meet sooner. You talk about the places you hung out and usually realize that you frequented the same coffee shop or bar or music venue, and you wonder if you were ever there at the same time. Were your phones to offer up their full history of where they’ve been, you could line up your personal tracking maps and find out the exact moment you might have encountered one another earlier in life.

Phone companies, however, have not historically allowed their customers to get access to that data. They have however handed it over to law enforcement when they wanted it. Police, of course, aren’t interested in your romantic history; when they do it, they’re looking for times people were in the same place to commit crimes or conspire to commit crimes, rather than to capture hearts. The data is used to incriminate people rather than to thrill them.

Most Popular

But over the past month, who gets access to the data created by that personal location tracker commonly referred to as a “smartphone” —and how easily— has undergone some dramatic changes. Google has made it easier for people to get access to their personal location histories, while federal judges in two different rulings, including one big one today in the Fourth Circuit Court of Appeals in Virginia, have made it harder for police to get access to it.

Last month, Google announced a feature called Timeline, that maps your past movements by mining location information from your photos and from times you had a Google app tracking your location on your phone. “Your Timeline allows you to visualize your real-world routines, easily see the trips you’ve taken and get a glimpse of the places where you spend your time,” Google said when it released the feature.

Timeline didn’t work for me, because I’d chosen not to let the search giant keep records of my movements. A less-private friend of mine declared his own Timeline “not very good.” “It didn’t record a whole lot over the past 6 years,” he said, seeming disappointed. “Though it seems like the quality has gotten much better recently.”

He shared what a recent trip to Vegas looked like:

Some people found the mapping tool creepy. A Redditor in a subreddit dedicated to “Adultery” warned fellow users to delete their location histories immediately so that snoopy significant others wouldn’t find out about their extramarital dalliances. Others loved the tech-enabled walk down memory lane. What I found most compelling about it is that, even if it’s not that good yet, it gives you a glimpse of what phone companies know about your movements. Unlike Google, phone companies keep a running log of your location any time your phone is on and not in airport mode. And so historical phone location data has become very useful to law enforcement as a time machine that lets them travel into the past to surveil citizens’ movements.

So far in 2015, law enforcement has asked AT&T for a history of customers’ locations 30,000 times. (Sprint, Verizon and T-Mobile don’t get this specific in their own transparency reports, unfortunately, but we can assume the numbers are comparable.) Historically, police have been able to get the equivalent of a Google Timeline for a U.S. citizen from a phone company pretty easily, just getting a subpoena for it, which is a mere formality when it comes to legal process, the legalese equivalent of saying “please.”

In the weeks after Google made it easier for people to get access to their location histories, a federal judge in California and a federal court in the 4th Circuit made it harder for police to get the same thing. Their rulings put them at odds with other federal courts, meaning the issue will likely make its way to the Supreme Court.

The 4th Circuit case, which was decided Wednesday, concerned robbers who hit a bank, 7-Eleven, fast food restaurants and a jewelry store in Baltimore; police were able to tie their crimes together by getting Sprint/Nextel to hand over the locations of their phones over 221 days. The case out of the Northern District of California which was decided last month, was more secretive about the details of the underlying crime, but also dealt with how easy it is for police to get “historical cell site information” from Verizon and AT&T for targets’ phones, which “generates a near-continuous record of an individual’s locations and movements,” in the words of the ACLU, which filed an amicus brief in the case.

When federal judge Lucy Koh raised the issue of privacy during a hearing over the California case, the federal prosecutor “suggested that cellphone users who are concerned about their privacy could either not carry phones or turn them off,” according to the Recorder.

In both opinions, which read quite similarly, federal judges ruled that making it this easy to track Americans is a violation of the constitutional right to be protected against unreasonable searches, writing that most people would never suspect that just carrying a phone around means they’ve completely forfeited their right not to be tracked by the government. Both cases note that Verizon, AT&T and Sprint don’t tell customers in privacy policies how pervasive location tracking is—potentially capturing a smartphone-toting customer’s location a hundred times in a day—nor say how long it’s stored. (AT&T stores it for five years, according to a letter it wrote to Congress in 2011.)

“We cannot accept the proposition that cell phone users volunteer to convey their location information simply by choosing to activate and use their cell phones and to carry the devices on their person,” wrote Judge Andre Davis in the Fourth Circuit opinion. “Cell phone use is not only ubiquitous in our society today but, at least for an increasing portion of our society, it has become essential to full cultural and economic participation.”

“Cell phone users do not expect that law enforcement will be able to track their movements 24/7 for a sixty-day period simply because the users keep their cell phones turned on,” Judge Koh wrote in the California case. (Apparently she doesn’t watch many heist films, in which the anti-heroes always ditch their phones to avoid being tracked.)

Koh called that expectation “eminently reasonable,” in the opinion, which cited a Pew survey from 2012 that found that 46% of teens and 35% of adults have turned off the “location setting” on their phones, signaling discomfort with their whereabouts being tracked. (Sorry, settings-savvy dudes, apps might be frustrated but phone companies still get your location every time your phone pings a cell tower, which is pretty often, and not just when you get a call, check your email, or send a text message. Phones are designed to be constantly on the look-out for the nearest tower to connect to.)

The rulings might seem like no-brainer decisions, but there’s a lot of significant privacy law precedent that says that once you’ve revealed information to a third party, it’s no longer “private.” The argument prosecutors made in these cases was that you let your phone company know everywhere you’ve been, so it’s not unreasonable for the government to be able to get that information too — unless a law is passed that says that information deserves extra protection (as has happened with email, a.k.a. “stored communications.”) Some states—Colorado, Maine, Minnesota, Montana, Tennessee, and Utah—have already passed laws saying police need to get a judge to issue a warrant before they can peek at the history of a smartphone-toter’s movements.

A dissenting judge on the Fourth Circuit agreed with the government’s argument, writing that the defendants don’t have a “reasonable expectation of privacy in the CSLI” because they allowed it to be recorded by Sprint/Nextel, and should know that it’s happening because every time they need to “get a signal” on their phone, they know they’re connecting to a nearby cell tower. Dissenting Judge Diana Motz writes that the decision puts the court in “conflict with the Supreme Court.” “Time may show that my colleagues have struck the proper balance between technology and privacy,” she wrote. “But if the majority is proven right, it will only be because the Supreme Court revises its decades-old understanding of how the Fourth Amendment treats information voluntarily disclosed to third parties.”

In both opinions, the judges emphasized the unreasonableness of the searches based on the fact that most smartphone users don’t actually know how much phone companies know about where they’ve been, and thus how much could be revealed to law enforcement. So if phone companies did decide to pivot and offer us up a Timeline-like feature with our location histories, making it clear just how much we track ourselves by carrying phones, it might actually reduce our “reasonable expectation of privacy” when it comes to our past movements.

But both decisions end on relatively happy notes for those worried about what the rapid adoption of data-collecting technology means for the future of privacy. “As the march of technological progress continues to advance upon our zone of privacy, each step forward should be met with considered judgment that errs on the side of protecting privacy and accounts for the practical realities of modern life,” stated a concurring opinion in the Baltimore case.

And in the California case, after citing a poll that found that nearly 75% of people have their phones within 5 feet of them most of the time, Judge Koh concluded that phones are a modern necessity that shouldn’t completely undermine our privacy. “It is untenable to force individuals to disconnect from society just so they can avoid having their movements subsequently tracked by the government,” she wrote.

Of course, that said, if you’re a modern smartphone addict, the government can see where you’ve been. They just need a warrant, at least in the places where state law requires it or where these rulings apply.