Habeas Data: Privacy vs. the Rise of Surveillance Tech - Hardcover

Über die Autorin bzw. den Autor

CYRUS FARIVAR is an investigative tech reporter at NBC News and the author of The Internet of Elsewhere. He is also a radio producer and has reported for the Canadian Broadcasting Corporation, National Public Radio, Public Radio International, The Economist, Wired, The New York Times, and others. He lives in Oakland, California.

Auszug. © Genehmigter Nachdruck. Alle Rechte vorbehalten.

Habeas Data INTRODUCTION

I believe in big data. I believe that large scale aggregation changes our ability—that one plus one plus one can equal 23.

—PAUL ROSENZWEIG

DEPUTY ASSISTANT SECRETARY FOR POLICY

DEPARTMENT OF HOMELAND SECURITY (2005–2009)

On December 13, 2010, two men ran into a RadioShack on East Jefferson Avenue in Detroit, just blocks away from Chrysler’s headquarters. One drew a gun, and demanded that the staff load up the latest smartphones into a few laundry bags. Within minutes, it was all over, and they’d made off with thousands of dollars worth of iPhones and Samsung handsets. Timothy “Little Tim” Carpenter sat in a nearby car, waiting for his accomplices to return.

Along with another man named Timothy “Big Tim” Sanders, Little Tim orchestrated a massive robbery ring, hitting T-Mobile and RadioShack stores in Michigan and Ohio. Eventually, some of the other robbers were caught, and they quickly flipped. Among the information that they gave to authorities was Little Tim’s phone number. This proved crucial. With it, authorities quickly got a court order and served it upon Little Tim’s cell phone company, MetroPCS. This court order, known as a d-order, for the portion of the 1980s-era Stored Communications Act, is routine. Companies respond to them all the time.

Under current law, no warrant is required to simply find out who called whom, when, and from where. Without batting an eye, MetroPCS turned over 127 days’ worth of Carpenter’s cell-site location data—effectively turning his own phone into a snitch. The 12,898 data points showed that yes, he was at the scene of the crime during the robberies. But the data also showed that he was at church many Sunday afternoons, and on occasion, spending the night somewhere that was not his known residence.

The case was successfully challenged all the way up to the Supreme Court. The question looms: Is it OK for law enforcement to obtain such a vast quantity of personal, intimate data about someone without a warrant?

On November 29, 2017, the nine justices heard oral arguments in Carpenter v. United States. Carpenter was represented by Nathan Freed Wessler, a thirty-five-year-old attorney with the American Civil Liberties Union (ACLU).

“At issue in this case is the government’s warrantless collection of 127 days of Petitioner’s cell site location information revealing his locations, movements, and associations over a long period,” Wessler said.

Before Wessler could even utter his fourth sentence in his opening argument, Justice Anthony Kennedy jumped in.

“What is the rule that you want us to adopt in this case, assuming that we keep [United States v.] Miller and Smith v. Maryland on the books?”

Justice Kennedy, most often dubbed the court’s crucial swing vote, was referring to two bedrock cases dating back to the 1970s, which enshrined the third-party doctrine. The idea of the third-party doctrine is that individuals relinquish their “reasonable expectation of privacy” when they transact via a third party, like a phone company. In other words, the data given up by Carpenter—not only what numbers he called, but where he was while doing so—can easily be obtained by the government.

In one short question, Kennedy was expressing the anguish that many judges have had to grapple with over the last half century: Where is the line between appropriate government action when it comes to the surveillance of its citizens? How much privacy do individuals have against the government’s use of surveillance technologies, ranging from simple microphones, to wiretaps, to thermal imagers, to cell-site simulators, to drones, and beyond?

In Carpenter’s case, rather than deploy humans to follow him or his fellow suspects, investigators simply went after his data at MetroPCS. Under the third-party doctrine, police did not need, much less try to obtain, a warrant. But to most ordinary citizens, myself included, this notion seems ludicrous. To the government, getting location data without a warrant is effectively the same thing as having a policeman make physical observations from the street. Modern technology has enabled so much data to be generated by all of us that it effectively has given the government superpowers.

“Although police could have gathered a limited set or span of past locations traditionally by canvassing witnesses, for example, never has the government had this kind of a time machine that allows them to aggregate a long period of people’s movements over time,” Wessler continued a few minutes later.

In other words, in the absence of a meaningful restraint, government authorities will continue to push as hard as they can.

Since the eighteenth century, some of the most aggressive law enforcement officers have known precisely where the legal limits were, and gone right up to them. Perhaps the most notable articulation of this idea in the twenty-first century came from General Michael Hayden, who served as both the head of the National Security Agency (NSA) and the Central Intelligence Agency. He has famously said since September 11, as a top intelligence official, he would play aggressively and fairly up to the line, so much so “that there would be chalk dust on my cleats.” While Hayden, as a lifelong Pittsburgh Steelers fan, was referring to the national security state, the same logic often applies for federal and local law enforcement as well.

However, the problem with playing to the edge is that sometimes the judicial system is given an impossible task: serving as a backstop to years of government overreach.

Where and how one can meaningfully withdraw from the watchful eye of the government in the early twenty-first century remains an open question. A half-century ago, the Supreme Court ruled that if someone steps into a phone booth and closes the door, we have a “reasonable expectation of privacy,” much in the same way that we do at home: in most cases the government needs a warrant first to legally surveil. But since that time, as technology has advanced incredibly quickly, the government has understandably adopted tools to its advantage.

When I first began as a professional reporter in 2004, I was largely dazzled by the excitement of new technology: Gmail was new. Facebook was just beginning. Ubiquitous Wi-Fi was just starting. Podcasts entered the lexicon. Rarely did I consider what impact all of this whizbang technology would have on society, and in particular, on law enforcement.

In 2005, I wrote my first story for Wired News about automated license plate readers (LPRs), and how they were being tested by the Los Angeles Sheriff’s Department (LASD). These specialized devices have quietly become pervasive in American law enforcement over the last decade. They rapidly scan, at 60 plates per second, when and where a license plate was seen. That data can be kept indefinitely.

When I was a young reporter, and didn’t really have the wherewithal to think about what it meant when then commander Sid Heal, of the LASD, told me that LPRs improved spotting stolen cars by “an order of magnitude.”

“This makes us more efficient than we’ve been in the past,” he said. “We would never check 12,000 license plates the conventional way.”

That sounded great! Who doesn’t want the police to retrieve more stolen cars? But, what I didn’t fully realize at the time was just like when Gmail made deleting e-mails practically obsolete, LPR data can also be kept forever. Given a large enough sample size, a pattern can easily be discerned.

I was slowly coming to the...