Federal Appeals Court Finds Geofence Warrants Are Categorically Unconstitutional

Even if practices so far have been unconstitutionally broad and sloppy, are there any scenarios where such a warrant for that kind of data could be valid?

For example, a small cottage in the woods is burned down with gasoline on a night the owner is absent. The police want to find the arsonist by asking for phones that connected to that tower that night, and there happen to be only 3 results, two of which are known neighbors. Still too broad?

In other words, should some of this hinge on the varying size/specificity of the result-set, rather than the query-parameters in isolation?

> it is essential that every person feels like they can simply take their cell phone out into the world without the fear that they might end up a criminal suspect because their location data was swept up in open-ended digital dragnet.

This single ruling, does nothing to make me feel any better about this. Everyone can be swept up in "some digital dragnet" because everyone's data is everywhere, and it's impossible to manage without hauling off to the woods and disconnecting from the internet at large.

I'm pretty up on current events, but I did not know/recall what a geofence warrant is. It's the "what cellphones pinged here" search warrant:

A geofence warrant is a type of search warrant that allows law enforcement to collect location data from devices within a specific geographic area (the "geofence") during a particular time period. This warrant enables investigators to:

1. Identify devices present in the area

2. Collect location data, such as GPS coordinates or cell tower information

3. Link devices to specific locations and times

This is fantastic. I’ve worked on this problem and it’s an incredible invasion of privacy.

However, until we get clarification from FISA courts we will still have to deal with it. The problem is the line where FISA has been used to acquire information for criminal prosecution rather than for intelligence purposes, and the broader and broader definition of terrorist and the dramatic expansion of domestic watchlists in recent times.

Let’s hope that it gets unilaterally outlawed and then FISA is forced to follow the supreme law of the land in future rulings.

Related:

No reasonable expectation of privacy in one's Google location data - https://news.ycombinator.com/item?id=40958458 - July 2024 (163 comments)

> Unsurprisingly, however, the court found that in 2018, police could have relied on such a warrant in “good faith,” because geofence technology was novel, and police reached out to other agencies with more experience for guidance. This means that the evidence they obtained will not be suppressed in this case.

That the guy's case gets a right affirmed yet in his individual case it won't make a difference has to be a pretty bitter pill to swallow.

Perhaps someone has already commented this, but LE can still purchase data from data brokers circumventing need for a warrant. That’s not to say that this isn’t an important step in the right direction, rather it’s to point out that there is still work to be done.

They are a very effective tool for finding burglars.

That's how many burglaries are solved in my area. If the exact time of the burglary is known (from alarm or security camera) a very specific warrant is given for all phone activity at or near that time at that location.

I'm hoping if the warrent is more specific (perhaps finding similar burglaries and requesting information only for matches between the two locations) they can still be used.

Naive question - how is geofence different than security camera footage of the street? It also includes indoor areas?

Can a FOIA request reveal if your phone has ever been included in one of these geofence warrants?

Interesting tangent to this is that Google has recently announced that they are shutting down their "Timeline" service in favor of having that information stored locally on the user device. I wonder if this is a "do no evil" reaction to geofence warrants -- if Google does not have the information they cannot give it to law enforcement. This has been Google's practice in other situation (GDPR) where retaining information inherently exposes Google's customers to law enforcement violations of their privacy via Google itself.

This is an interesting decision in historical context for several reasons.

First, the Fifth Circuit is conservative. It includes Texas, Louisianna and Alabama. It's become known as the fast-track to the Supreme Court as it has ruled very conservatively at both the district and appellate level. This problem is exacerbated by how the Fifth Circuit is organized where the districts in the circuit are divided into divisions of often 1-2 judges, allowing plaintiffs to very effectively "judge shop".

Second, in modern times the Fourth Amendment has been consistently weakened by successive Supreme Court. A notable example if the 1968 case Terry v. Ohio that allowed police to stop people and search them without probably cause. Another huge example if the whole concept of civil asset forfeiture, which was justified by (IMHO) the most contorted mental gymnastics: this pile of money has no rights. But it was found in someone's car. How is it not their property and thus the Fourth Amendment limitation on unlawful search and seizure should apply?

Third, the Supreme Court will likely take this case up now. Why? Because the Fourth and Fifth Circuits have issued conflicting rulings. That's when the Supreme Court steps in, more often than not.

Fourth, if a user's location data has a rasonable expectation of privacy, it raises the question of what other data has a reasonable expectation of privacy? What about law enforcemen tuse of Stingrays? Or facial recognition systems?

> As the court noted, geofence warrants require a provider, almost always Google, to search “the entirety” of its reserve of location data

I haven't read the ruling, but this has always struck me as the key problem with geofence warrants that courts have been ignoring. A geofence warrant doesn't just involve a search of the location data that is in the area, it involves a search of all the location data collected worldwide to determine that it wasn't in the area. It couldn't be less localized.

The most important thing to remember reading this, for most of us (including myself) is the phrase:

  I Am Not A Lawyer

The construction of "but what does it mean" invites the response: "it depends". I wouldn't depend on a theory or statement from anyone not involved in the law here. I have no idea how this will or will not limit the use of geofence technology, warrented or otherwise.

Cities are already building their own tracking networks with APLR, Bluetooth, TPMS, toll transponders, etc.

I would imagine someday, police will say geofence every radio detected by a their (or third parties) sensors network and then drive around looking for those radios, or wait until they pass one of their detectors again.

This is especially problematic as a bad actor will turn off or leave their phone at home, then go perform the crime. Since it is human to be lazy, the investigators may just go for the devices they drag into the net, leaving the real perp untouched.

This is encouraging especially as an increasing number of our watches and cars have cellular chips in them. It’s not like you can just hid your phone in a silent pocket and be excluded from these anymore.

So, this is about taking a blind sample of an area to see if anyone is suspicious.

This is in contrast to having a named suspect, and then analyzing their phone data to see if they were in the area? That's still legit discovery?

Fifth Circuit being our only check and balance is amusing to me

But I can appreciate the distributed nature of this system

Interesting constrast with the Las Vegas room searches.

I like how they take 15 years to work these issues through the courts, meanwhile untold thousands of people have their rights violated.

> the quintessential problem with these warrants is that they never include a specific user to be identified, only a temporal and geographic location where any given user may turn up post-search

In that case, it's illegal to look in the phone book for names starting with "john" because that's not a specific user.

From the ruling emphasizes a search through the "entire" database as a kind of rummaging through everything in a house, but that's clearly inapt. First, it shouldn't matter whether Google just needs to check an index vs. doing a full scan. Second, there's no reason to assume a digital search has the same privacy implications as a house search. It's just assuming what you're trying to prove. `While the results of a geofence warrant may be narrowly tailored, the search itself is not` is relevant only if the search itself is an invasion of privacy.

So even (especially?) if I preferred the result in this case, that reasoning is not likely to hold up in a conflict with the 4th circuit. It's exactly this kind of weak conflict that gives the Supreme Court too much latitude to draw lines as they see fit.

edit: sorry, removed disrespect for the EFF