[00:00.000 --> 00:00.400]  Again.
[00:01.440 --> 00:03.840]  Man, I can't believe you guys let me come talk to you twice.
[00:04.760 --> 00:05.960]  You guys are suckers.
[00:06.800 --> 00:07.400]  All right.
[00:08.320 --> 00:10.140]  Oh, that's not going to work.
[00:11.320 --> 00:15.500]  They say the camera adds 15 pounds, so there must be like 30 cameras on.
[00:15.900 --> 00:16.500]  All right.
[00:16.700 --> 00:18.560]  Well, hopefully we can get these slides going.
[00:18.720 --> 00:19.700]  Oh, there we go.
[00:19.920 --> 00:20.660]  There we go.
[00:20.760 --> 00:21.160]  Much better.
[00:21.780 --> 00:22.440]  All right.
[00:22.640 --> 00:23.380]  Yeah, this is much better.
[00:23.540 --> 00:30.600]  Okay, so I'm here today to talk to you folks about cell site location data and non-trespassery surveillance after United States versus Jones.
[00:30.720 --> 00:31.440]  I'm Hanni Fakhoury.
[00:31.640 --> 00:38.800]  I'm a staff attorney with the Electronic Frontier Foundation, and I want to say thank you, first of all, for all of your generosity to our organization.
[00:39.320 --> 00:43.740]  You are the people we strive to serve, so thank you, thank you, thank you very much.
[00:44.040 --> 00:47.420]  Now, what am I talking about today?
[00:47.520 --> 00:50.280]  Cell site location data and non-trespassery surveillance.
[00:50.280 --> 00:52.220]  That sounds like a bunch of gobbledygook.
[00:52.700 --> 00:59.040]  What I'm really here to talk to you folks today about is location privacy after the U.S. Supreme Court's decision in United States versus Jones.
[01:02.320 --> 01:20.340]  We're going to talk about Jones in a lot more detail, but just for anyone who doesn't know what Jones is, it's basically a Supreme Court case from January of this year where the Supreme Court held that the physical installation of a GPS device constituted a search under the Fourth Amendment.
[01:20.720 --> 01:41.540]  And we're going to go through more detail than you maybe want to know about that case, but it's important detail because it really shows not only what the case stood for and its limitations, but importantly, the future fights we're going to have in terms of dealing with location privacy in the years and decades to come, okay?
[01:42.840 --> 01:46.620]  So what is cell site location data?
[01:46.620 --> 01:56.140]  You all in this room are probably far more technologically sophisticated than I am and could probably answer this question better than I could.
[01:56.320 --> 02:12.420]  But just so we have, you know, a uniform understanding of what I'm going to talk about very briefly, all I'm talking about today in terms of cell site location data is the information stored in cell phone towers by cell phone providers as you are trying to,
[02:12.700 --> 02:15.020]  you know, make a phone call or just walking down the street.
[02:15.020 --> 02:28.040]  So if you walk down on Seventh Avenue, you've got your cell phone in your pocket, you pull it out because you want to make a phone call or send a text message or whatever, you know, you pull it out, you're a Verizon customer, you have four bars, you're an AT&T customer,
[02:28.160 --> 02:29.020]  you have a half a bar.
[02:30.660 --> 02:48.160]  It's that service strength, that signal strength is really what we're talking about because every time the phone is, you know, you're walking down the street, that phone is establishing a connection with a cell phone tower and the providers are keeping a record of which cell phone tower your particular phone number interacts with.
[02:48.960 --> 02:57.160]  Now, through technological advances, the government has been able to basically go to providers and get this information.
[02:57.480 --> 03:01.060]  And again, we're going to talk about how they do that a little bit later on.
[03:01.180 --> 03:08.220]  But I wanted to start by just laying out the foundation, the groundwork of what exactly the technology is that we're dealing with today.
[03:08.440 --> 03:17.560]  So let's talk briefly about sources of legal protection you have with respect to cell site location data.
[03:17.800 --> 03:21.320]  Well, first, you have your protection under the Fourth Amendment, okay?
[03:21.580 --> 03:25.920]  The Fourth Amendment generally prohibits unreasonable searches and seizures.
[03:26.060 --> 03:37.440]  And what that really means is that in order for the police or any law enforcement agency to search your electronic device or to seize your electronic device, they have to get a search warrant.
[03:37.620 --> 03:52.700]  And a search warrant, all that really is, is a law enforcement officer goes to a judge and swears out an affidavit and says they have probable cause to believe that there's evidence to be found in the thing they want to search or the thing they want to take,
[03:53.020 --> 03:53.360]  okay?
[03:54.420 --> 03:59.200]  So that's the first source of legal protection we have for this type of data, the Fourth Amendment.
[03:59.480 --> 04:07.900]  The second type of legal protection we have is from the Electronic Communications Privacy Act, or as we affectionately call it, ECPA.
[04:08.360 --> 04:10.040]  Now, ECPA is complicated.
[04:10.040 --> 04:12.080]  There are a lot of different parts of ECPA.
[04:12.660 --> 04:19.380]  I'm not going to bore you all with that, but I think there's, there are really two important parts of ECPA that we should be focusing on.
[04:19.460 --> 04:28.600]  So the first part that we need to focus on is this provision of ECPA that says that you have to, that the government has to get a search warrant to install a quote-unquote tracking device.
[04:28.600 --> 04:34.580]  Now, what is and is not a tracking device is complicated.
[04:34.720 --> 04:38.560]  And this is the definition of tracking device under federal law.
[04:38.720 --> 04:44.500]  It's an electronic or mechanical device which permits the tracking of the movement of a person or object.
[04:44.740 --> 04:55.800]  Now, again, I don't want to bore you with a ton of dense legal argument, but suffice it to say that a cell phone for purposes of ECPA is not a tracking device.
[04:56.080 --> 05:08.620]  And that is why there are some constitutional and statutory questions surrounding what type of legal showing the government has to make in order to get access to cell site location data.
[05:08.780 --> 05:23.080]  And in fact, the legislative history from ECPA, which was enacted in 1986, shows that when they defined this term, a tracking device, what they really were trying to capture is basically beeper technology.
[05:23.360 --> 05:29.720]  This is like a little honing device that they would place on something and then follow the little red beep as it was driving down the street.
[05:29.900 --> 05:34.240]  So this was far removed from the actual state of technology that we have today.
[05:35.180 --> 05:37.120]  So keep that in mind.
[05:37.380 --> 05:41.600]  Now, for those of you who wanted to go to law school, guess what?
[05:41.660 --> 05:42.140]  You're in luck.
[05:42.240 --> 05:45.120]  You're going to get a five-minute crash course on the Fourth Amendment.
[05:45.120 --> 05:47.160]  I just saved you all $150,000.
[05:47.740 --> 05:50.260]  You can thank me with a donation to the EFF later.
[05:50.660 --> 05:50.720]  Okay.
[05:51.120 --> 05:59.920]  Now, again, this is important because it's going to frame our discussion of Jones and our discussion of cell site location data later on in this presentation.
[06:00.100 --> 06:03.380]  And just as a quick caveat, I am going to leave time at the end for questions.
[06:03.380 --> 06:07.240]  So if you do have questions, I'm going to take them, but we're just going to save them until the very end.
[06:07.380 --> 06:07.660]  Okay.
[06:09.880 --> 06:14.660]  So the real question under the Fourth Amendment is, what is and is not a search?
[06:14.960 --> 06:20.100]  And there are two cases that lay the groundwork for what a search and search isn't.
[06:20.100 --> 06:23.280]  The first case is a case called Olmstead from the 1920s.
[06:23.340 --> 06:25.240]  And in this case, it was a wiretapping case.
[06:25.600 --> 06:32.180]  The Supreme Court, excuse me, held that a search required a physical invasion of property.
[06:32.340 --> 06:34.560]  In other words, it required a trespass.
[06:35.080 --> 06:40.780]  And in the Olmstead case, because there was no actual physical invasion of property, there was no search.
[06:40.920 --> 06:43.700]  And that was the law for almost 40 years.
[06:44.280 --> 06:59.260]  Then in 1967, the Supreme Court seemingly, but as we'll later find out, not really, but seemingly reversed Olmstead when it held that a search did not require a physical invasion of property or a trespass.
[06:59.960 --> 07:02.520]  Katz was also a wiretap case.
[07:02.680 --> 07:08.000]  It was about a microphone that police had installed on the outside of a public phone booth.
[07:08.780 --> 07:12.080]  They were investigating evidence of illegal gambling.
[07:12.600 --> 07:18.840]  And what Katz decided was it created a new definition of what a search is.
[07:18.900 --> 07:25.120]  And it said that something could be a search in the absence of a physical invasion if two things were met.
[07:25.480 --> 07:30.460]  First, there had to be a violation of a subjective expectation of privacy.
[07:30.700 --> 07:40.900]  That means that whatever the thing that is to be searched, the person must have taken some sort of steps or believed that that thing was going to remain private.
[07:41.740 --> 07:47.140]  Second, society would have to find that expectation of privacy reasonable.
[07:47.440 --> 07:51.680]  We shorten this to the reasonable expectation of privacy test.
[07:51.800 --> 07:56.600]  And that is still, to this day, the test of what constitutes a search under the Fourth Amendment.
[07:56.860 --> 08:16.540]  So if some sort of police action meets this definition of search, so both a subjective expectation of privacy and society would find that expectation of privacy reasonable, then whatever the government is doing is a search and therefore requires a search warrant unless it falls under some of the exceptions to the search warrant rule,
[08:16.560 --> 08:17.940]  which I'm not going to talk about today.
[08:19.220 --> 08:23.660]  So that's the crash course on what a search is under the Fourth Amendment.
[08:23.900 --> 08:28.900]  The second thing we have to talk about is the right to privacy in public movements.
[08:29.060 --> 08:34.480]  And there's a pair of Supreme Court cases from the 1980s that elaborated on this, Knott's and Caro.
[08:34.620 --> 08:41.620]  And these were both cases that involved this beeper technology, the red honing device that the cops are following from a distance.
[08:42.020 --> 08:55.620]  In both of those cases, a transmitter was attached to a suspect's car in one instance, and in another instance, a can of ether that the defendant was transporting, and it emitted a radio signal.
[08:55.820 --> 09:02.900]  And ultimately, that signal was sent to a receiver, and the police had the receiver and could follow the suspect from a distance without revealing their location.
[09:03.280 --> 09:14.820]  And the Supreme Court held that these beepers did not violate a, you know, well, they said that there was no reasonable expectation of privacy in a person's movements on public streets.
[09:14.820 --> 09:33.760]  Now, it distinguished between using this type of technology in the home, but it said in terms of walking down the street or driving down the street, you have no reasonable expectation of privacy, because you're voluntarily conveying to anyone who wanted to look where you were going.
[09:34.380 --> 09:34.680]  Okay?
[09:34.680 --> 09:39.820]  So, that's the second important concept under the Fourth Amendment that we have to understand.
[09:40.060 --> 09:43.780]  And the third important concept is what's called the Third Party Doctrine.
[09:44.120 --> 09:58.340]  Now, this is born out of a pair of cases from the 1970s that involved whether a person could challenge a search or a seizure, rather, by the government of certain records held by someone else.
[09:58.480 --> 10:06.280]  And what the Supreme Court held was that you have no right of privacy and information that's knowingly turned over to third parties.
[10:07.120 --> 10:09.100]  Miller involved bank records.
[10:09.340 --> 10:14.160]  Smith involved the phone numbers you dial in order to make a phone call.
[10:14.560 --> 10:26.320]  Now, what's important about these two cases is that in a dissenting opinion, Justice Marshall, this is specifically in the Smith opinion, he really questioned this idea of a third party doctrine.
[10:26.460 --> 10:35.840]  And what he really was upset about was he did not believe there was any real choice when you use certain kinds of technology.
[10:36.120 --> 10:47.300]  Because the only alternative to turning over this, your information, which in Smith again, it was the phone numbers you dial in order to make a phone call, the only alternative is to not use that type of technology at all.
[10:47.420 --> 10:51.020]  So he questioned whether there really was any choice in the matter.
[10:51.460 --> 11:00.480]  The other important point he made is he did not believe that privacy was a all or nothing proposition.
[11:00.780 --> 11:08.920]  And a very kind of famous and really nice quote he has is that secrecy is not a prerequisite to privacy.
[11:09.240 --> 11:19.560]  This is, I think, a very, very important mindset that we all need to have in terms of how to combat intrusions of privacy going forward in the future.
[11:19.760 --> 11:28.420]  And as we'll see when we discuss Jones, at least one Supreme Court justice has started to pay attention to what Justice Marshall said in Smith.
[11:29.740 --> 11:37.120]  Now, how does ECPA and cell site location data, how do they interact?
[11:37.260 --> 11:38.520]  So we talked about the Fourth Amendment.
[11:38.720 --> 11:40.180]  Let's talk about ECPA for a second.
[11:40.980 --> 11:50.620]  The government has argued it can obtain cell site location data without a search warrant because it's a record of other information pertaining to a subscriber.
[11:50.860 --> 11:52.520]  Here's how their argument works.
[11:53.100 --> 12:12.220]  Under Title 18 USC 2703, you are permitted to obtain a record or other information pertaining to a subscriber under another section of 2703D specifically under another subsection of 2703, specifically 2703D.
[12:12.440 --> 12:29.600]  And 2703D says that records or other information pertaining to a subscriber can be obtained through specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire, electronic communication, or the records of other information sought or relevant material to an ongoing criminal investigation.
[12:29.860 --> 12:32.000]  Now, if you're thinking, what the hell does that mean?
[12:33.220 --> 12:35.220]  The important parts are in red.
[12:35.540 --> 12:49.400]  The government can get this data, at least that's what they've argued, under a showing of specific unarticulable facts that show there's reasonable grounds to believe the contents are relevant and material to a criminal investigation.
[12:49.400 --> 12:55.660]  The most important thing to take from this is that this is not the search warrant probable cause standard.
[12:56.020 --> 13:07.360]  So the probable cause standard means that the government has to have probable cause to believe that evidence of a crime will be obtained from the place that they want to search.
[13:07.560 --> 13:09.300]  This is not that standard.
[13:09.540 --> 13:11.200]  It is a lesser standard.
[13:13.800 --> 13:27.860]  Now, before the Jones case, the issue of whether or what type of standard was required in order to get cell site location data resulted in a split of opinion.
[13:28.300 --> 13:36.500]  And really, what the issue hinged on was kind of a combination or a conflation of ECPA and the Fourth Amendment, okay?
[13:38.700 --> 13:46.100]  So some courts have held that cell site location data can be disclosed without a search warrant under the third-party doctrine.
[13:46.100 --> 13:51.660]  The idea that you have no privacy rights in records that are held by third parties, okay?
[13:52.020 --> 14:10.100]  And these two cases are just an example, but they basically follow through the Supreme Court cases in Smith and Miller and say, look, as a cell phone customer to Verizon or AT&T or whatever, you are knowingly turning over your location effectively because you're demanding service from the provider.
[14:10.240 --> 14:12.560]  And in order to do that, they have to create a record.
[14:12.560 --> 14:15.880]  They create that record as a means of furthering their business business.
[14:16.380 --> 14:21.280]  And it's created at, you know, for business purposes, not for law enforcement purposes.
[14:21.480 --> 14:26.620]  And therefore, the third-party doctrine controls, it does not require a search warrant, okay?
[14:28.340 --> 14:30.760]  Other courts have required a warrant.
[14:31.000 --> 14:39.260]  And their rationale is that cell site location data reveals sensitive data and can potentially intrude in the home.
[14:39.440 --> 14:48.180]  And importantly, these courts have looked at Justice Marshall's dissenting opinion and the idea that these records are actually not voluntarily given over.
[14:48.340 --> 14:50.780]  And there's a number of different reasons for that.
[14:50.920 --> 14:56.800]  Some courts have looked and said, look, you may sign a contract agreement, effectively like a EULA.
[14:57.120 --> 14:59.000]  And, you know, nobody reads these things.
[14:59.140 --> 15:00.620]  Everyone, it's 50, 100 pages.
[15:00.860 --> 15:03.440]  It's written in language that lawyers can't even understand or read.
[15:03.660 --> 15:04.740]  People just sign it, whatever.
[15:04.920 --> 15:07.960]  So they're not knowingly turning that over, okay?
[15:08.920 --> 15:25.040]  And importantly, this idea that this information reveals sensitive data and could potentially, if precise enough, intrude into the home takes it outside of the realm of Knott's and Caro, the cases that talked about public movements on public streets.
[15:25.220 --> 15:30.640]  Because if once we go into the home, the Fourth Amendment protections are much, much stronger, okay?
[15:31.360 --> 15:35.800]  So this is kind of the state of the law before the Jones case.
[15:35.940 --> 15:43.840]  So now let's shift gears and talk about Jones and we'll talk how it kind of impacts cell site location data.
[15:44.020 --> 15:46.140]  So the facts of Jones.
[15:46.380 --> 16:00.100]  Basically, the police were investigating Jones for drug crimes and they applied and obtained a search warrant that allowed them to install a GPS device in the District of Columbia within 10 days.
[16:00.660 --> 16:08.460]  So the federal government, being the federal government, decided to wait 11 days and waited until Jones was in Maryland and then decided to install the GPS device.
[16:08.880 --> 16:18.140]  Because it was installed outside of the parameters or the limits of the search warrant, it effectively was a warrantless search, okay?
[16:19.320 --> 16:27.780]  Now, on appeal, the DC Circuit found that this violated the Fourth Amendment right to be free from unreasonable searches and seizures.
[16:28.060 --> 16:32.800]  And they based their decision on what's been called this, the mosaic theory.
[16:33.420 --> 16:55.740]  What the mosaic theory and what the DC Circuit said was that even though Jones exposed individual trips to the public, meaning he may have driven five blocks down the street and anybody could see that, he didn't actually or constructively expose the entirety of his movements over the period of time in which he was tracked.
[16:55.920 --> 16:58.980]  Which, I forgot to mention, in this case, was 28 days.
[16:59.200 --> 17:02.140]  So the police followed him through GPS for 28 days.
[17:02.360 --> 17:18.100]  So they said even though he may have disclosed discrete trips, he didn't knowingly or constructively or actually expose his movements for almost a month because nobody in their right mind would believe that anybody would follow them around for a month.
[17:18.280 --> 17:28.120]  Now, after going to the talk yesterday about drones, that may not be true anymore, but at least at the time that this case was decided, that was what the DC Circuit held.
[17:28.380 --> 17:41.960]  And what... and a very important holding to come out of this is the idea that there's an acknowledgement of a greater privacy interest in the pattern or aggregation of individual movements than in each individual discrete movement in and of itself.
[17:42.580 --> 17:42.640]  Okay?
[17:43.000 --> 17:47.380]  So the government was the one who asked the Supreme Court to review.
[17:47.500 --> 17:48.420]  The Supreme Court agreed.
[17:48.600 --> 18:01.040]  And the issue before the Supreme Court was whether the attachment of the GPS tracking device to an individual's vehicle and subsequent use of that device to monitor the vehicle's movements on public streets is a search or seizure within the meaning of the Fourth Amendment.
[18:01.260 --> 18:01.520]  Okay?
[18:02.780 --> 18:11.960]  Now, the Jones case was argued in November and a ton of organizations filed amicus briefs, including the EFF.
[18:12.280 --> 18:15.680]  We got the guy who invented GPS to sign on to our brief, which was pretty awesome.
[18:16.740 --> 18:20.760]  And the court issued its decision in January of this year.
[18:20.940 --> 18:26.360]  And it's actually a pretty... for a Supreme Court opinion, it's actually a pretty easy read.
[18:26.460 --> 18:29.220]  I think someone without a legal background could definitely read it.
[18:29.280 --> 18:30.740]  I'd encourage all of you to read it.
[18:31.180 --> 18:36.160]  You know, it's not like the health care case, which I tried looking at and I couldn't figure it out, so I put it away.
[18:36.880 --> 18:40.800]  But basically, the Jones case resulted in three opinions.
[18:40.980 --> 18:42.560]  And each of those opinions are very important.
[18:42.760 --> 18:45.920]  So the first opinion is the majority opinion written by Justice Scalia.
[18:46.220 --> 18:52.980]  And what he held was that the government occupation of private property for the purpose of obtaining information is a search.
[18:53.520 --> 18:58.840]  So he goes back to the Olmstead test of a physical trespass.
[18:59.020 --> 19:09.540]  And what he says is that the CATS reasonable expectation of privacy test did not substitute for the trespass test.
[19:09.720 --> 19:11.060]  Instead, it was added to.
[19:11.260 --> 19:15.060]  So what that means is there's now actually two ways the Fourth Amendment can be violated.
[19:15.220 --> 19:20.040]  Either through this trespass or through a violation of a reasonable expectation of privacy.
[19:20.240 --> 19:20.580]  Okay?
[19:20.820 --> 19:27.600]  So that's actually pretty groundbreaking, because that's the first time the Supreme Court's ever held that actually both tests are correct.
[19:28.500 --> 19:34.720]  So this is a good holding for the physical attachment of GPS devices.
[19:34.920 --> 19:40.400]  But it doesn't really help us in cell site location data, because there is no physical installation.
[19:40.920 --> 19:45.940]  And Justice Scalia very specifically says, yeah, that's true.
[19:46.160 --> 19:50.320]  We don't have to decide the case through the reasonable expectation of privacy test.
[19:50.440 --> 19:52.260]  So we're just going to leave it that for another day.
[19:52.580 --> 19:53.020]  All right?
[19:53.360 --> 19:56.920]  The second opinion is a concurring opinion by Justice Alito.
[19:56.920 --> 20:02.400]  And he does not agree that this trespass test decides the issue.
[20:02.520 --> 20:07.320]  Instead, he says the reasonable expectation of privacy test controls.
[20:07.520 --> 20:15.600]  And his rule would be the use of longer term GPS monitoring in investigations of most offenses impinges on expectations of privacy.
[20:15.800 --> 20:22.900]  Now, unfortunately, he doesn't bother to explain what the words longer term or most offenses means.
[20:23.240 --> 20:26.400]  He says 28 days is definitely it, and that's the end of that.
[20:26.800 --> 20:32.260]  So under his theory, there's room to figure out, you know, is one day enough?
[20:32.420 --> 20:33.260]  Is five days enough?
[20:33.300 --> 20:36.060]  I don't know the answer to that under Justice Alito's theory.
[20:36.220 --> 20:40.100]  Is a murder case okay for GPS tracking?
[20:40.300 --> 20:41.480]  How about a drug case?
[20:41.680 --> 20:42.780]  We don't really know.
[20:43.060 --> 20:44.580]  He's left it kind of vague.
[20:44.840 --> 20:55.000]  But what he does say, and what's very important going forward is he notes that in the past, our greatest privacy protections were technological in a sense.
[20:55.260 --> 21:07.580]  That it's just impractical for the police to follow somebody for 28 days with cops in an unmarked car and a box of donuts and a big jug of coffee following your every movement.
[21:07.700 --> 21:09.280]  It's just not likely.
[21:09.500 --> 21:11.680]  It's impossible, one would even argue.
[21:12.140 --> 21:28.740]  But because of the rapid advances in technology, what's happening is these things that once seemed impossible or extremely difficult, and that would only be used very, very sparingly, are now able to be used easily and cheaply.
[21:28.760 --> 21:33.560]  And for things that are not all that, that we would consider, you know, traditionally very serious.
[21:35.280 --> 21:38.740]  He also notes that legislatures have to be the ones to step in.
[21:38.840 --> 21:45.700]  And that he notes that traditionally, it has been the legislature to dictate what people's expectations of privacy are.
[21:45.780 --> 21:51.560]  At least they're in a better position to gauge what expectations of privacy people have in society rather than the courts.
[21:51.680 --> 22:00.200]  And he notes that as technology advances, many people may be willing to sacrifice their privacy for the conveniences of technology.
[22:00.320 --> 22:07.800]  Meaning like if people like to check in on Foursquare or Facebook or whatever, and if that means giving away your location, then so be it.
[22:08.720 --> 22:12.600]  Now, I'm fairly confident that most of the people in this room wouldn't agree with that.
[22:12.740 --> 22:24.680]  But I think unfortunately, the reality is, to a lot of people outside of this room, down on 7th Avenue, maybe visiting New York City for the first time, they may be very comfortable disclosing that where they are at any particular moment.
[22:24.860 --> 22:25.160]  Okay?
[22:25.320 --> 22:26.540]  So that's something to think about.
[22:26.800 --> 22:30.140]  And finally, we have the concurring opinion of Justice Sotomayor.
[22:30.260 --> 22:33.000]  Now, she basically agrees with both Scalia and Alito.
[22:33.140 --> 22:36.540]  So she thinks the trespass theory is correct.
[22:36.680 --> 22:41.780]  She also thinks that there needs to be an analysis under the reasonable expectation of privacy test.
[22:41.900 --> 22:45.860]  She thinks that this surveillance violated a reasonable expectation of privacy.
[22:46.020 --> 22:59.420]  She also agrees with Justice Alito about the fact that technology advances could potentially erode our expectations of privacy and that we have to be vigilant in protecting them.
[22:59.580 --> 23:10.300]  But most importantly, and what I'm going to probably focus the rest of my comments on, is she is the one to kind of set the signal off that it's time to re-examine the third-party doctrine.
[23:10.800 --> 23:29.840]  And what she says is that this approach is ill-suited for the digital age that we live in, where so much information is being turned over and placed online, whether it's through cloud storage or people walking around with smartphones in their pocket and having their email and their financial data and all sorts of stuff contained on their electronic devices.
[23:30.440 --> 23:30.540]  Okay?
[23:31.060 --> 23:33.060]  Now, this is all...
[23:34.520 --> 23:43.020]  This is a great first step in the right direction that we're even having judges on the Supreme Court of United States actually thinking about this.
[23:43.240 --> 23:52.860]  Because up until the Jones case, there really hadn't been any location privacy cases since the 1980s, when Knott's and Carroll were decided.
[23:53.100 --> 23:57.040]  So this is, at least in my opinion, this is a great starting point.
[23:57.040 --> 23:59.100]  But there's a lot more work to be done.
[23:59.400 --> 24:04.540]  So, what is the state of the law regarding cell site location data after Jones?
[24:04.720 --> 24:07.400]  Well, unfortunately, the courts remain split.
[24:07.720 --> 24:12.780]  So, after the Jones case, here are an example of two cases that went out the opposite way.
[24:12.940 --> 24:20.640]  In Pitt, which is a Massachusetts state court case, it relies on the concurring opinions in Jones to find that cell site location data.
[24:20.920 --> 24:24.780]  Obtaining it without a search warrant would violate a reasonable expectation of privacy.
[24:24.980 --> 24:37.940]  And it not only touches upon the concurring opinions in Jones, but it also touches upon the prior opinions that had found this type of searching to be unconstitutional without a search warrant.
[24:38.140 --> 24:41.720]  Noting that users don't really voluntarily turn this information over.
[24:41.920 --> 24:45.480]  That it has the potential to reveal far greater sensitive information.
[24:46.060 --> 24:49.820]  And, you know, also noting that the third party doctrine shouldn't control this outcome.
[24:50.300 --> 24:59.280]  Graham, which is a federal court case out of Maryland, went the opposite way and basically said, look, you know, Justice Alito and Sotomayor's opinions are really nice.
[24:59.440 --> 25:00.380]  They're very well written.
[25:00.380 --> 25:01.920]  But they're concurring opinions.
[25:02.360 --> 25:03.540]  That majority didn't hold that.
[25:03.660 --> 25:05.360]  The third party doctrine still survives.
[25:07.940 --> 25:13.320]  Unfortunately, what we're seeing now is we're seeing differing standards amongst different law enforcement agencies.
[25:13.540 --> 25:16.300]  And we're seeing lots and lots and lots of requests.
[25:16.480 --> 25:28.360]  So in March, the ACLU released the results of a FOIA request that showed that throughout the country, different law enforcement agencies were using different types of judicial process to get access to the state.
[25:28.440 --> 25:31.960]  And I'd encourage everyone to go check out their on their website.
[25:32.120 --> 25:38.220]  They have the results and you can do a search by your state or county or whatever to figure out what your local law enforcement agency is doing.
[25:38.500 --> 25:42.720]  But for example, in the state of Hawaii, the police were using search warrants to get this data.
[25:43.360 --> 25:49.780]  Meanwhile, other state court law enforcement officials were getting it with 2703D order.
[25:49.780 --> 25:51.380]  Some were trying to use subpoenas.
[25:52.340 --> 25:55.320]  I've gone to like a talk with a U.S. attorney in the Bay Area in Oakland who said that she would basically use a 2703D order to get this information.
[26:01.660 --> 26:06.440]  So we're seeing a disparity and discrepancies on how this data is being obtained.
[26:06.760 --> 26:10.660]  And we're also seeing a rapid increase in the number of requests.
[26:11.060 --> 26:23.220]  Last week, you know, the New York Times reported the results of a request made by Representative Markey of Massachusetts asking cell phone providers to disclose how many requests they'd received in the year 2011.
[26:23.540 --> 26:31.280]  And the number was, I think, 1.3 million individual requests made to cell phone providers for information.
[26:31.500 --> 26:36.840]  Now, it wasn't just cell site location data included, you know, requests for text messages, emails, et cetera.
[26:37.000 --> 26:40.740]  But certainly included in that was cell site location data.
[26:40.920 --> 26:57.040]  And even more problematic were these tower dumps where law enforcement could go to a provider and say, hey, we want all the data you have on this particular cell phone tower on 7th and 34th, and they just turn it all over.
[26:57.140 --> 27:04.000]  And it doesn't matter if it's one person's info on there or a thousand people who've connected to that tower, the cops get all of it.
[27:04.100 --> 27:09.500]  And we don't know how long they're keeping it or what they're doing with it or what databases they're storing with it.
[27:09.620 --> 27:18.080]  We're, you know, a lot of the civil liberties community, we're trying to figure that information out, but we still are in the dark to a certain extent about some of this stuff.
[27:19.180 --> 27:24.100]  And finally, we've got DOJ resisting a warrant requirement.
[27:24.440 --> 27:48.980]  And on May 3rd of 2012, Jacob Weinstein, who's an assistant attorney general, told a panel in DC that requiring a search warrant would, quote, cripple, end quote, law enforcement efforts because the police oftentimes use cell site location data to develop a probable cause in order while investigating other crimes.
[27:48.980 --> 27:59.440]  So we're seeing a very strong push by law enforcement to, you know, challenge the notion that search warrants are required to access this data.
[28:01.300 --> 28:11.520]  I think the most interesting thing to come out of the Jones case in terms of how it interacts with cell site location data is really the third party doctrine.
[28:11.800 --> 28:27.000]  And I think we... I don't want to say we're seeing the beginning of the end because I don't think we are, but we're starting to see the beginning of the reexamination of the third party doctrine.
[28:27.180 --> 28:47.700]  And because cell site location data records are records held by third parties, AT&T, Verizon, T-Mobile, whatever, it's really going to be the resolution of the third party doctrine that impacts how this area of the law is going to develop and the types of privacy protection that we're going to have in the future.
[28:48.700 --> 29:01.280]  With that, I'm going to say a little plug, and that is that third parties have to be transparent and limited and assertive when they do get requests from law enforcement on how to handle cell site location data.
[29:01.380 --> 29:08.740]  Because that's, you know, in a sense, it's my rights are in their hands, and I hope that they're being transparent, limited, and assertive.
[29:08.840 --> 29:15.300]  And there's a case here in New York that I want to talk about in some detail that I think kind of brings some of these issues to a head.
[29:15.300 --> 29:18.540]  And I'm sure a lot of people have heard about this case, but this is the case of People v. Harris.
[29:19.480 --> 29:22.940]  For those of you who haven't heard about this case, I'll give a brief recap.
[29:23.900 --> 29:32.420]  Harris was one of the people arrested on the Brooklyn Bridge during an Occupy Wall Street protest in October of 2011.
[29:32.820 --> 29:41.000]  And he was charged with disorderly conduct, which is under New York law, an infraction, which is a step below misdemeanor.
[29:41.080 --> 29:42.220]  So it's a pretty minor crime.
[29:42.340 --> 29:46.520]  It's got a $250 maximum fine or up to 15 days in jail.
[29:46.640 --> 29:48.440]  It's not the most serious crime in the world.
[29:48.740 --> 30:01.920]  And as part of their investigation, the New York City District Attorney's Office sent a subpoena to Twitter asking for any and all information it had about Harris over a three-month period of time.
[30:02.100 --> 30:04.740]  Now, he was arrested on October 1st of 2011.
[30:05.080 --> 30:28.680]  Yet, despite that very specific pinpoint date, and that is the only... that is the only day of... that the charges are based on, not that he was doing other things before that, just solely on October 1st, 2011, the government nonetheless requested all of the information Twitter had on Harris from September of 2011 all the way through December of 2011.
[30:28.900 --> 30:31.040]  Or in other words, after the crime had occurred.
[30:31.500 --> 30:40.500]  And that included tweets, it included contact lists, it included what's considered basic subscriber information.
[30:40.500 --> 30:48.220]  And this is where location data is important because part of the information that Twitter keeps is IP addresses.
[30:48.860 --> 30:52.320]  Now, the majority of people use Twitter on their cell phone.
[30:52.580 --> 31:09.440]  So what that means is, if you post a... if you log into Twitter on your cell phone and you tweet, and you... Twitter has a record of the IP address you're connecting from, they, technically speaking, have a record of the cell phone tower you potentially connected to.
[31:09.920 --> 31:17.560]  And particularly because Harris was arrested on the Brooklyn Bridge, I'm going to assume he doesn't actually live on the Brooklyn Bridge.
[31:18.200 --> 31:26.140]  It's safe to say that they were, at least, you know, we suspected, that they were trying to get some information about Harris's location.
[31:26.480 --> 31:29.460]  And they did this through a subpoena, not through a search warrant.
[31:29.960 --> 31:38.360]  Now, Harris, with the help of the good people of the NLG, shout out to them, uh, challenge this subpoena.
[31:38.600 --> 31:46.440]  And what the court held was, Harris had no legal standing to challenge the subpoena.
[31:46.900 --> 31:54.160]  Legal standing is the concept that you are the one who has suffered some sort of injury and can therefore bring a legal claim.
[31:54.320 --> 31:58.960]  And the court found that Harris had no standing because he didn't own his own tweets.
[31:59.400 --> 32:02.460]  Rather, that information was owned by Twitter.
[32:02.760 --> 32:06.360]  And because Twitter was the one who owned it, Harris couldn't challenge it.
[32:07.000 --> 32:18.460]  So, Twitter, thankfully, awesome, mad props to them, stood up and defended Harris effectively and filed a motion challenging, you know, the disclosure of this information.
[32:18.620 --> 32:24.420]  And we, EFF together with ACLU and public knowledge, filed an amicus brief in support of Twitter.
[32:24.620 --> 32:33.020]  And we gave them a lot of love on our website and told them this is awesome, this is the exact thing we want to see, a third party being transparent and attempting to be limited.
[32:33.640 --> 32:36.500]  And most importantly, being assertive on behalf of one of its users.
[32:37.020 --> 32:40.280]  So, they filed this challenge to the subpoena.
[32:40.860 --> 32:49.740]  And just unfortunately, however, about I think two weeks ago, the judge issued another opinion basically saying, yeah, what I said in that first opinion where I said you can't challenge it, it holds true here.
[32:49.860 --> 32:55.620]  And what the court said was, you have no privacy rights and information turned over to third parties.
[32:55.640 --> 32:58.000]  It's exactly this, the third party doctrine.
[32:59.560 --> 33:09.600]  I'm confident that this case is going to go up through the court system and hopefully will work its way up to the New York appellate court level and the Court of Appeals.
[33:09.940 --> 33:13.280]  And I think we're going to see other examples of this.
[33:13.380 --> 33:32.060]  But we have to ask ourselves, are other third parties that we're storing data with, particularly those who potentially have records of where we access our data, and if we're our location or potentially our location, are they going to be assertive in the same way that Twitter is?
[33:32.580 --> 33:34.700]  That remains to be seen.
[33:35.760 --> 33:52.480]  So, I'm almost at the end here and then we're going to take some questions, but you're probably, hopefully, well, I'm sure, you know, I've said a lot of doom and gloom, but there is some stuff that you all can do to help in this fight.
[33:52.500 --> 33:54.040]  So, what can I do?
[33:54.180 --> 33:58.160]  Well, one, you can continue EFF's fight on cell site location data.
[33:58.300 --> 34:15.160]  So, this is a case, this case that's listed up here, is a case where the EFF, the ACLU, and the National Association of Criminal Defense Lawyers and the Center for Democracy and Technology have filed a brief in the Fifth Circuit Court of Appeals defending a judge who told the government,
[34:15.240 --> 34:17.640]  you can't get cell site location data without a search warrant.
[34:17.880 --> 34:21.340]  And we are looking for other cases where these types of situations come up.
[34:21.480 --> 34:27.820]  So, know that at least directly speaking, we are litigating this issue and are looking for, you know, other ways to do so.
[34:28.000 --> 34:31.400]  So, that's, that's, you know, you can, by supporting EFF, you're helping in that fight.
[34:32.760 --> 34:41.960]  There are two, you know, at least as far as I know, legislative proposals that are pending that would require search warrants for the police to get location data.
[34:42.080 --> 34:43.460]  The first is the GPS Act.
[34:43.640 --> 34:52.300]  This is a bill introduced in Congress last year, but it's, it's taken a little bit of time for it to work its way through.
[34:52.480 --> 34:53.740]  It's a bipartisan bill.
[34:54.480 --> 35:00.520]  So, it's in the House version was introduced by Republican Chaffetz from Utah.
[35:00.860 --> 35:03.940]  The Senate version was introduced by Senator Wyden from Oregon.
[35:04.160 --> 35:10.760]  So, this bill would require law enforcement to get a search warrant before using, before obtaining basically any location type data.
[35:10.980 --> 35:25.220]  And in California, there's a Location Privacy Act that the EFF and the ACLU have sponsored together that would also require law enforcement to get a search warrant before accessing location data, including both GPS and cell site location data.
[35:26.200 --> 35:35.080]  Understandably, they've met with a lot of law enforcement resistance, not to mention even some resistance from wireless providers, at least in the California example.
[35:35.920 --> 35:42.780]  In the California bill, there was initially some stringent reporting requirements that would hopefully create more transparency.
[35:42.980 --> 35:51.860]  So, we didn't have to have congressmen writing letters to cell phone providers to figure out what they were doing and how much record keeping and turning over to the government they were doing.
[35:52.300 --> 35:56.720]  But they were able, you know, able to lobby and get that taken out of the bill, you know.
[35:56.900 --> 36:00.260]  So, there is some, you know, resistance to these types of ideas.
[36:00.480 --> 36:09.120]  But, you know, you all can get involved by writing your representative or expressing your support for these two types of legislative proposals.
[36:10.900 --> 36:12.660]  You can also protect yourself.
[36:12.740 --> 36:19.000]  And I'm going to point you to my colleague, Marsha Hoffman, who yesterday gave a presentation on protecting your data from the cops.
[36:19.120 --> 36:20.760]  You should do everything she tells you to do.
[36:20.900 --> 36:21.620]  She's very smart.
[36:21.760 --> 36:23.700]  And she's got your best interest at mind.
[36:23.900 --> 36:37.700]  And I also, there's a blog post by one of our activists, Eva Galperin, who wrote a guide about a cell phone guide for Occupy Wall Street protesters and also everybody else, about how you can protect yourself and protect your data.
[36:37.960 --> 36:40.460]  But there's one other thing I want to talk about.
[36:40.460 --> 36:42.520]  And I'm going to end on this and then take questions.
[36:42.740 --> 36:46.080]  And that's about technological measures.
[36:46.320 --> 36:49.720]  And I think this goes under-reported.
[36:49.860 --> 36:58.020]  Or, I think there's not enough emphasis placed on this, at least by, you know, people like myself, who I've talked about this issue before.
[36:58.160 --> 37:02.140]  And I've never really talked about it in terms of looking at the technology.
[37:02.320 --> 37:12.840]  Like I said before, you know, we have to be encouraging of technologies that only store limited amounts of data and only keep that data for as long as necessary.
[37:13.660 --> 37:25.400]  And I put up here two, you know, examples of different ways by which companies and, you know, technology actors, so to speak, can take steps to limit what they do.
[37:25.640 --> 37:27.740]  And I'm not here to endorse either proposal.
[37:27.880 --> 37:33.440]  I'm just pointing them out there to say, you know, these are examples of things that the tech community needs to talk about.
[37:33.820 --> 37:48.680]  But I'll start by noting that in March of 2012, an FTC report said that companies should incorporate substantive privacy protections into their practices, such as data security, reasonable collection limits, sound retention practices, and data accuracy.
[37:48.840 --> 37:53.060]  Now, unfortunately, the FTC didn't bother to define what any of those things mean.
[37:53.220 --> 37:57.400]  And maybe for better or for worse, that's not necessarily a bad thing that they didn't define it.
[37:57.500 --> 38:03.180]  I mean, we can have the debate over whether we want the FTC explaining what should and shouldn't be done on the Internet.
[38:03.260 --> 38:05.140]  And we can have that conversation later.
[38:05.280 --> 38:20.440]  But, you know, both privacy by design and privacy engineering are ideas that say, look, when technologies are being built from the ground up, there needs to be privacy protections embedded in them from the very beginning, whether that's done through, you know,
[38:20.840 --> 38:36.800]  just thinking about them and, you know, incorporating them in, you know, the way, you know, a particular app, you know, what type of permission an app is given, or whether it's done by engineering and making limits saying our company is going to agree,
[38:36.960 --> 38:40.140]  we're only going to keep data for 10 days, 30 days, whatever it may be.
[38:40.420 --> 38:46.300]  These are some sound, you know, ideas that technologists need to think about in order to protect my privacy.
[38:46.320 --> 38:54.580]  Because in some sense, for those of you out there who work for companies who store data, again, my privacy rights are in your hands.
[38:55.000 --> 39:03.980]  So, we need your help in ensuring that as technology is being developed, privacy protections are embedded in them from the very, very beginning, okay?
[39:04.480 --> 39:06.320]  So, now this is the time for questions.
[39:06.360 --> 39:08.300]  And if you have questions, feel free to come on up.
[39:08.400 --> 39:09.340]  There's a microphone right there.
[39:09.460 --> 39:12.180]  I'm going to try to get to as many questions as I have time for.
[39:12.260 --> 39:15.200]  We've got about, I think, a little under 20 minutes.
[39:15.380 --> 39:17.840]  So, you know, hopefully some questions will come up.
[39:18.720 --> 39:20.580]  And while people line up, I'm going to get some water.
[39:34.180 --> 39:35.300]  All right, first one, go ahead.
[39:35.300 --> 39:54.040]  Yeah, so I'm curious, given the sort of parameters or the limited parameters of law enforcement that you're talking about, I'm curious where or what our protections are legally, where the NSA is concerned, and like that level of executive oversight or insight.
[39:54.880 --> 39:58.340]  So, that's kind of a different issue.
[39:59.000 --> 40:09.020]  And like FISA is a whole completely different animal that I'm not going to talk about in any detail today.
[40:09.200 --> 40:20.940]  But what I will say is that a lot of the privacy protections I'm talking about are unfortunately reduced when we start to bring in national security or we say the T word, okay?
[40:21.280 --> 40:30.740]  And there have been attempts to amend FISA to bring it back more in line with traditional Fourth Amendment protections.
[40:30.800 --> 40:39.320]  Unfortunately, they haven't really gone anywhere because there's a lot of political pressure to be tough on national security threats.
[40:39.520 --> 40:48.740]  But there's definitely not as much transparency and there's definitely not as much privacy protection that we have in those situations.
[40:48.980 --> 40:53.100]  And again, there are a lot of kind of nitty-gritty particulars we could get into at another point.
[40:53.220 --> 41:02.480]  But all I would say is they're not as strong as they are when we're talking about kind of like domestic Fourth Amendment issues and related concerns, okay?
[41:03.440 --> 41:04.640]  Super presentation.
[41:04.860 --> 41:05.040]  Thank you.
[41:05.040 --> 41:05.340]  Many thanks.
[41:06.040 --> 41:13.380]  Cell phone spyware allows a third party to track your movements with astonishing precision.
[41:13.720 --> 41:18.060]  You can turn on the microphones of your cell phone and listen to room conversations.
[41:18.260 --> 41:32.540]  I hope everybody, if you're not familiar with the dangers of cell phone spyware, or at least Google it when you're finished with this presentation, as well as listen to all your telephone conversations and read all your text mail, text messages and email.
[41:33.240 --> 41:41.020]  Aren't these technologies even more insidious and dangerous because they don't require going to Twitter or a third party?
[41:41.360 --> 41:47.340]  And how do we protect ourselves against the dangers of cell phone spyware being used by the government?
[41:47.460 --> 41:53.020]  I understand the FBI has used it in the past with a number of criminal investigations.
[41:53.780 --> 41:54.980]  So thank you for the question.
[41:55.760 --> 41:57.620]  Hell yeah, that stuff is really crazy.
[41:58.240 --> 42:09.400]  And, you know, I think there's like the practical things you can do, you know, like, you know, be careful who, you know, again, this is a very technical audience.
[42:09.600 --> 42:11.680]  So I think a lot of these things are going to sound really obvious.
[42:12.400 --> 42:19.040]  You know, you know, you'd be careful who you download apps from, you'd be careful, you have to be careful with what websites you visit on your cell phone.
[42:19.080 --> 42:20.700]  I think those things are pretty common sense.
[42:20.940 --> 42:29.380]  But in terms of like the government's use of this technology, we are starting to see this more often, like, for example, like Stingray, which is like a fake cell phone tower.
[42:29.660 --> 42:32.720]  And that raises a whole host of different issues.
[42:32.840 --> 42:44.480]  They're less about, at least when the government's using technologies like the Stingray, for example, they don't bring up necessarily that third party doctrine issue, which in a way is actually better.
[42:44.960 --> 42:50.700]  Because, you know, the third party doctrine is an obstacle we're trying to overcome.
[42:50.980 --> 42:55.420]  So if the government is the one doing it directly, in some sense, you've got a stronger Fourth Amendment claim.
[42:55.560 --> 42:59.960]  Now, that doesn't mean I want them to do it more often, so I can have better Fourth Amendment arguments.
[43:00.220 --> 43:14.960]  But again, I think it's something that as technology advances, and as we turn, more of these examples become aired out, we need to, as a community, you know, stand up together, whether that's through the legal process and bringing legal challenges and having people willing to,
[43:15.000 --> 43:27.440]  you know, fight for this type of privacy, whether it's through the companies standing up for their users the way that Twitter did, and whether it's through technologists who are able to develop technologies that are both, you know, privacy protective,
[43:27.680 --> 43:31.840]  but also that are, you know, able to combat some of these privacy and truth.
[43:32.600 --> 43:36.980]  So I feel like from the legal side, I know, just enough to feel really stupid about things like this.
[43:37.020 --> 43:37.660]  You're not the only one, no worries.
[43:38.360 --> 43:52.280]  But from a technical side, I have to ask, these subpoenas have to at some point be filed, right, with a court and something in the range of, it would go into PACER, it would go into a system somewhere that would be publicly accessible because they're public court records.
[43:52.920 --> 44:01.520]  Would it be possible for the EFF to write a script, a website, a tool that looks for these, that trolls for these, and automatically files a challenge?
[44:01.540 --> 44:03.420]  Or do you not have standing to do that?
[44:04.260 --> 44:05.020]  Um, hmm.
[44:05.200 --> 44:05.740]  Good question.
[44:06.060 --> 44:15.400]  The standing is definitely going to be an issue because we can't just file blank lawsuits and say we are challenging every particular subpoena that we don't agree with.
[44:15.440 --> 44:19.060]  We have to have a client and an individual who's harmed by it.
[44:19.920 --> 44:27.820]  More generally speaking, though, I think it's important to distinguish between a subpoena and a search warrant because subpoenas are not necessarily placed on PACER or on the public docket.
[44:27.980 --> 44:30.760]  And oftentimes they come in under seal.
[44:31.420 --> 44:40.560]  Search warrants are a little bit different and they eventually will make it onto PACER if a criminal case is filed, but oftentimes they'll remain sealed.
[44:41.060 --> 44:50.520]  And so the problem is it's almost easier to get access to the search warrants than it is to get access to the subpoenas oftentimes.
[44:51.340 --> 44:58.960]  Particularly because a lot of this stuff, like AT&T, let's use them as an example, you know, or any large ISP or cell phone company.
[44:59.320 --> 45:04.280]  They're going to have a whole department whose job it is to process these subpoenas.
[45:04.580 --> 45:18.060]  And unless there's somebody like, you know, Google who issues a transparency report that tells us we got X number of subpoenas on in this particular year, we just don't know how many requests they're getting, what their requests are for.
[45:18.280 --> 45:21.580]  We just have to kind of take their word that they're complying with the law.
[45:22.140 --> 45:36.940]  So there are obstacles and there are difficulties, but I mean, I would definitely welcome anyone who wants to find a way to, you know, bring, you know, bring subpoenas or search warrants that seem questionable to us and we can examine them and, you know,
[45:36.980 --> 45:42.140]  use that as a way to develop a legal strategy or technical strategies to combat these problems.
[45:43.140 --> 45:46.680]  Just one quick follow-up to this question.
[45:46.900 --> 45:57.020]  I think we may need to make a distinction between a subpoena, which is not controlled by anybody except for that agency, and a warrant, which is judicial control over the agency.
[45:57.200 --> 45:59.080]  So that's too... Absolutely, absolutely.
[45:59.320 --> 46:05.540]  And just real quick before, and I'll let you get to your question, you know, a subpoena doesn't... a subpoena is stamped by the clerk of the court.
[46:05.740 --> 46:07.380]  It's not stamped by a judge.
[46:07.600 --> 46:10.340]  There's no judicial oversight in a subpoena at all.
[46:10.940 --> 46:14.520]  But search warrant... and this is why we want search warrants.
[46:14.900 --> 46:16.300]  The judge has to approve it.
[46:16.440 --> 46:20.420]  The judge can set limits, you know, like in Jones, for example, the judge said 10 days.
[46:20.560 --> 46:21.040]  That's what you get.
[46:21.720 --> 46:29.080]  And after the search warrant is executed, they have to... you know, law enforcement has to return to the judge with an inventory.
[46:29.180 --> 46:30.400]  This is what we took.
[46:30.640 --> 46:41.080]  And it's an open legal question how much limit drawing the judges can do, but there's at least some procedural protections there that are that are otherwise absent with subpoenas.
[46:41.200 --> 46:41.220]  Yeah.
[46:41.400 --> 46:42.380]  Anyway, please ask your question.
[46:42.480 --> 46:59.100]  In the battle of trying to secure rights for third party rights, or where an individual can have... retain his rights through a third party, has the legal profession looked to analogous situations?
[46:59.440 --> 47:01.040]  One comes right off to mind to me.
[47:01.180 --> 47:07.120]  If I have a safety deposit box in a bank, I have that right to keep that thing private in there.
[47:07.600 --> 47:25.200]  But say if tomorrow there's a technology that can x-ray, and they can look into the contents of that box, and all of a sudden, not only that, but they can look in the computer and match up whose box that is, then they know what person has what in a certain box.
[47:25.320 --> 47:34.740]  So I think a safety deposit box has been traditionally viewed as a private item, and that government can't go in there, unless if they actually have a search warrant.
[47:35.040 --> 47:37.680]  They can't subpoena what is in my box.
[47:37.840 --> 47:46.200]  So have you guys looked to analogous situations to present good arguments for this?
[47:46.340 --> 47:50.120]  There is one case that is very similar to the situation.
[47:50.120 --> 47:52.460]  It's called United States versus Warshak.
[47:52.560 --> 47:59.530]  This was a case that looked at what privacy protection under the Fourth Amendment, under the Fourth Amendment you have for email.
[48:00.610 --> 48:10.550]  And email has a long tortured history of, under ECPA, in a nutshell, just so it's clear.
[48:10.830 --> 48:18.830]  ECPA says email that is stored in your inbox for less than 180 days requires a search warrant.
[48:19.190 --> 48:22.630]  And email that's stored for more than 180 days does not.
[48:22.630 --> 48:23.070]  Okay?
[48:23.950 --> 48:28.130]  We can, again, I could have a whole two-hour lecture about... Do you agree with that?
[48:28.390 --> 48:29.490]  No, absolutely not.
[48:29.650 --> 48:29.710]  Right.
[48:29.910 --> 48:30.010]  Right.
[48:30.610 --> 48:31.010]  Never.
[48:32.030 --> 48:32.550]  Thank you.
[48:32.730 --> 48:34.430]  If I did, I wouldn't work for the EFF, right?
[48:35.290 --> 48:36.610]  Yeah, I'd be thrown out of town.
[48:36.670 --> 48:49.910]  But anyway, in Warshak, the court looked at that and said, hey, well, the court found, look, despite what ECPA says, people do maintain a reasonable expectation of privacy in their email.
[48:50.470 --> 49:02.910]  Because you, even though, let's say you have a Gmail or Yahoo mail or whatever, even though, technically speaking, you know, Google is holding your email, you don't expect them to just open it and read through your email, hopefully.
[49:03.170 --> 49:09.270]  And it's the same... and therefore, you know, the court found the Fourth Amendment protects that.
[49:09.510 --> 49:15.050]  So, you know, we've used that case in trying to argue the cell site location data argument.
[49:15.850 --> 49:26.290]  And courts, the courts that are, you know, that have held that cell site location data is protected under the Fourth Amendment requires a search warrant have certainly looked and turned to Warshak.
[49:26.390 --> 49:40.350]  And the courts that have said, no, you know, we don't think cell site location data requires a search warrant, they've distinguished Warshak by saying there's a big difference between email, which anyone would generally recognize is private and belongs to you,
[49:40.410 --> 49:43.110]  even though it's held by Google or Yahoo or whatever.
[49:44.050 --> 49:50.850]  And cell site location data, which when you really think about it, at least this is what the courts have said, when you think about it is the company's record.
[49:51.110 --> 49:55.470]  The company is the one who owns and maintains and creates and keeps that record.
[49:55.610 --> 49:58.190]  I don't agree with that, but that is what the courts have held.
[49:59.150 --> 50:00.910]  Just one quick little thing.
[50:01.050 --> 50:04.970]  It's funny how free speech all of a sudden becomes the record of the companies.
[50:06.330 --> 50:09.570]  Again, that's a whole other can of worms, yeah.
[50:10.250 --> 50:12.390]  I had a question about the third-party data.
[50:12.870 --> 50:26.770]  I've been told that it doesn't make much difference whether your data is in another country, or particularly Canada or Europe, that the U.S. law enforcement has a way of going in and accessing and cooperating with law enforcement in other countries.
[50:26.950 --> 50:28.990]  But I was wondering if you could comment on that.
[50:29.070 --> 50:32.010]  Particularly, I know Iceland has passed laws that are more protective.
[50:32.210 --> 50:43.230]  If there's any legal or practical experiences you've had with U.S. law enforcement going after data, third-party data, that it's either stored in a server or in a company based in another country.
[50:43.490 --> 50:50.810]  So, I have to confess that I'm not all that well-versed on the contours of international access to it.
[50:50.970 --> 51:07.890]  What I will say is that depending on the country, oftentimes the procedure... many international countries, what they have basically said is, look, if the process is valid under American law and you meet certain additional requirements required like, you know,
[51:07.950 --> 51:11.450]  under English law or Canadian law or whatever, that generally it's going to be turned over.
[51:11.670 --> 51:14.450]  But anything more specific than that, I just...
[51:14.450 --> 51:17.570]  honestly, I don't know and I wouldn't feel all that comfortable answering and telling you the wrong thing.
[51:17.670 --> 51:18.070]  Sorry, Jamie.
[51:18.670 --> 51:19.290]  Last question.
[51:20.070 --> 51:20.430]  All right.
[51:20.630 --> 51:24.590]  I read the case and just... Which one?
[51:24.590 --> 51:25.830]  The Jones case.
[51:26.210 --> 51:26.250]  Okay.
[51:26.610 --> 51:27.610]  And just to get it right.
[51:28.410 --> 51:30.110]  The guys, the investigators, right?
[51:30.230 --> 51:31.030]  They did the right thing.
[51:31.190 --> 51:32.190]  They got the warrant.
[51:32.970 --> 51:37.490]  But they... It was for one state and they actually did it in a different state, right?
[51:37.910 --> 51:38.050]  Yes.
[51:38.050 --> 51:41.230]  And also, it was for 10 days and they did it after the 10 days.
[51:41.330 --> 51:41.510]  Yes.
[51:41.770 --> 51:44.590]  So, this is bad procedure.
[51:45.150 --> 51:45.590]  Absolutely.
[51:46.130 --> 51:48.530]  And just because of that, we're asking all these questions.
[51:48.530 --> 51:54.890]  And also, I agree with you that Sotomayor's opinions about what... how different it is now with the digital age.
[51:55.710 --> 51:57.430]  It's the right way to actually look at it.
[51:58.510 --> 51:58.990]  That's... Yeah.
[51:59.070 --> 52:06.790]  I mean, I think... I think the point is, and a lot of us asked, of all the cases for the government to take up to the Supreme Court, this was the absolute worst one.
[52:06.970 --> 52:08.990]  But thankfully, we got a pretty good opinion out of it.
[52:09.070 --> 52:10.370]  So, we should thank them for that too.
[52:10.510 --> 52:12.170]  So, anyway, that's all the time I have for it.
[52:12.350 --> 52:12.510]  Thanks.
[52:12.630 --> 52:13.090]  Thanks very much.