A full panel of judges at the Fourth US Circuit Court of Appeals has now overturned last summer’s notable decision by the standard trio of appellate judges, which had found that police needed a warrant to obtain more than 200 days' worth of cell-site location information (CSLI) for two criminal suspects.

In the Tuesday en banc decision, the Fourth Circuit relied heavily upon the third-party doctrine, the 1970s-era Supreme Court case holding that there is no privacy interest in data voluntarily given up to a third party like a cell phone provider. That case, known as Smith v. Maryland, is what has provided the legal underpinning for lots of surveillance programs, ranging from local police all the way up to the National Security Agency.

The Fourth Circuit concluded in US v. Graham:

The Supreme Court may in the future limit, or even eliminate, the third-party doctrine. Congress may act to require a warrant for CSLI. But without a change in controlling law, we cannot conclude that the Government violated the Fourth Amendment in this case. … The Fourth Amendment does not protect information voluntarily disclosed to a third party because even a subjective expectation of privacy in such information is "not one society is prepared to recognize as ‘reasonable.’" Smith, 442 U.S. at 743 (internal quotation marks and citation omitted). The government therefore does not engage in a Fourth Amendment "search" when it acquires such information from a third party.

In the decision, the judges also noted that the Supreme Court has "forged a clear distinction" between metadata ("non-content") and content. In the Fourth Circuit’s finding, CSLI "undeniably belongs in the non-content category," but the court noted that "Congress remains free to require greater privacy protection if it believes that desirable."

While the Supreme Court has never ruled definitively on this issue before, recent cases, including one that overturned the police’s warrantless GPS monitoring of a suspect (US v. Jones, 2012) suggests that the high court may be receptive to a challenge of the third-party doctrine in the future.

"The simple act of carrying a cell phone does not give the government the right to track our every move," Meghan Skelton, Graham’s public defender, told Ars by e-mail. "People expect this intimate information to remain private."

Skelton added, "We will definitely petition the Supreme Court for further review."

Have it your way

As Ars reported previously, the case dates back to February 5, 2011, when two men robbed a Burger King and a McDonald’s in Baltimore—10 minutes later, they were caught and cuffed by Baltimore City Police officers. Eventually, Aaron Graham and Eric Jordan were charged with 17 counts of robbery, including the pair of fast food robberies.

A Baltimore City Police detective first sought and obtained a search warrant for the two cell phones recovered during a search of the getaway car. Prosecutors later obtained a court order (a lesser standard than a warrant) granting disclosure of the defendants’ CSLI data for various periods totaling 14 days when the suspects were believed to have been involved in robberies. The government then applied for (and received) a second application to another magistrate judge for a new set of CSLI data, covering a period of July 1, 2010 through February 6, 2011 (221 days).

At the district court level, the defendants argued in a motion to suppress this evidence because "the privacy intrusions available through this type of technology are far-reaching and unconstitutional—allowing the government to retroactively track or survey a suspect through his cellular telephone, a device he likely carries with him at all hours of the day and to constitutionally protected places such as his home or church." However, a district judge sided with the government, also relying on the third-party doctrine, and denied the defendants’ motion.

Welcome to the future

In dissent, Circuit Judge James A. Wynn disagreed with the majority of his colleagues, noting that the difference between the actions in question in Smith and other cases is that the defendants voluntarily conveyed the information that the government eventually obtained. As he argued, anyone who uses a credit card knows that those transactions will be recorded by the issuing company, and similarly, any mobile phone user knows that call records will be kept by that phone company.

However, even if mobile phone owners have a "vague awareness" that their location affects the quality of the connection, "they surely do not know which cell tower their call will be routed through." Therefore, Judge Wynn reasoned, they cannot possibly know that detailed location information is being transmitted and retained by their carrier.

Judge Wynn, who was appointed to the Fourth Circuit by President Obama, also added, "The majority does not take seriously this idea—that information might be automatically generated without user involvement."

He underscored this point with a reference to a 2013 law journal article entitled "The Dangers of Surveillance" that highlights the expansion of the Internet of Things, which does and will expand data collection without any human interaction.

"Today, the majority saddles us with a rule that does not distinguish between information an individual himself conveys and information that computerized devices automatically record, generate, and transmit," Wynn wrote. "In other words, the majority’s expansive interpretation of Miller and Smith will, with time, gather momentum—with effects increasingly destructive of privacy."