In 2018, the Supreme Court created a revolution in the Fourth Amendment. In Carpenter v. United States, the Court found that the government needed a warrant to obtain data about the cell phone towers to which a person connected when using their phone. That data can reveal the digital breadcrumbs of a person’s life – including where they went and how long they stayed. But cell phone users give that location data to their phone providers, third-party companies like AT&T and Verizon. Those companies don’t have the legal ability to challenge a government’s request for the user’s data. In fact, the companies often can’t even notify the user about a request for information. This creates a paradox. Cell phone users, the people who have a Fourth Amendment right to challenge the government’s request for information, don’t know the government is requesting it and third-party companies know about the request but can’t challenge it in court.
The third-party paradox has massive implications for privacy rights and raises important questions about how to challenge the government’s request for information that might be protected by the Fourth Amendment.
Joining the show to discuss the third-party paradox and the Fourth Amendment is Michael Dreeben. Michael argued Carpenter and over 100 other cases before the Supreme Court on behalf of the government. He is now a partner at the law firm O’Melveny & Myers, a Distinguished Lecturer from Government at Georgetown University Law Center, and a Lecturer on Law at Harvard Law School.
Show Notes:
In 2018, the Supreme Court created a revolution in the Fourth Amendment. In Carpenter v. United States, the Court found that the government needed a warrant to obtain data about the cell phone towers to which a person connected when using their phone. That data can reveal the digital breadcrumbs of a person’s life – including where they went and how long they stayed. But cell phone users give that location data to their phone providers, third-party companies like AT&T and Verizon. Those companies don’t have the legal ability to challenge a government’s request for the user’s data. In fact, the companies often can’t even notify the user about a request for information. This creates a paradox. Cell phone users, the people who have a Fourth Amendment right to challenge the government’s request for information, don’t know the government is requesting it and third-party companies know about the request but can’t challenge it in court.
The third-party paradox has massive implications for privacy rights and raises important questions about how to challenge the government’s request for information that might be protected by the Fourth Amendment.
Joining the show to discuss the third-party paradox and the Fourth Amendment is Michael Dreeben. Michael argued Carpenter and over 100 other cases before the Supreme Court on behalf of the government. He is now a partner at the law firm O’Melveny & Myers, a Distinguished Lecturer from Government at Georgetown University Law Center, and a Lecturer on Law at Harvard Law School.
Show Notes:
Paras Shah: In 2018, the Supreme Court created a revolution in the Fourth Amendment. In Carpenter v. United States, the Court found that the government needed a warrant to obtain data about the cell phone towers to which a person connected while using their phone. That data can reveal the digital breadcrumbs of a person’s life – including where they went and how long they stayed. But cell phone users give that location data to their phone providers — third-party companies like AT&T and Verizon. Those companies don’t have the legal ability to challenge a government’s request for the user’s data. In fact, the companies often can’t even notify the user about a request for information. This creates a paradox. Cell phone users, the people who have a Fourth Amendment right to challenge the government’s request for information, don’t know the government is making it and third-party companies know about the request, but can’t challenge it in court.
The third-party paradox has massive implications for privacy rights and raises important questions about how to challenge the government’s request for information that might be protected by the Fourth Amendment.
Welcome to the Just Security Podcast. I’m your host, Paras Shah.
Joining the show to discuss the third-party paradox and the Fourth Amendment is Michael Dreeben. Michael argued Carpenter and over 100 other cases before the Supreme Court on behalf of the government. He is now a partner at the law firm O’Melveny & Myers, a Distinguished Lecturer from Government at Georgetown University Law Center, and a Lecturer on Law at Harvard Law School.
Hi Michael, welcome to the show. Thanks so much for joining us today.
Michael Dreeben: Thank you, Paras. It's a pleasure to be here.
Paras: We’re going to talk about a case called Carpenter v. United States, a case that you argued in the Supreme Court and some of the problems that it's caused. And you wrote a series of Just Security pieces about it in which you call this problem Carpenter’s paradox. Could you start by telling us what is that paradox? What's the problem here?
Michael: Yes, the issue that's raised by Carpenter flows from its innovative approach to the kinds of things in which we have a privacy interest. Carpenter involved cell site information that telephone companies collect every time our cell phone connects to a cell tower, which for most of us is hundreds, if not thousands, of times a day. The question in Carpenter was whether the government could get that information from a cell company without using a search warrant. And the court held in an innovative pathbreaking decision that the answer was no, a search warrant was required, because people have a reasonable expectation of privacy in the whole of their physical movements, which are revealed by cell-site information.
What that decision did was break with a prior line of cases that it basically held, look, if you give information to a third party, the government can go to that third party and get the information and you, the user, have no basis for objecting. Carpenter broke that mold, and in doing so, it opened up a series of questions. When can we can a user complain that the government has violated the Fourth Amendment when it acquires private information from a third party? And the paradox is this — the only person who holds a privacy interest in the information is the user, not the company that has the information about the user. But when the government uses a subpoena, or a search warrant, or any other form of process to ask the company for the information, it usually gets an order telling the company not to disclose the fact that it's received in order to the user. So the user never knows, and the company can't object on behalf of the user.
That creates the third party paradox that I wrote about. People may have a protected Fourth Amendment interest under Carpenter against having the government get their information, but the person never knows it until it's too late. The cat is out of the bag, and the company has already turned the information over.
Paras: Right, so just to give an example and follow this, if I'm walking down the street and using my cell phone, I might pass several different cell towers. And, the government could be interested in that information because it tells them a lot about my movements. It could tell them about my habits in the course of a week, or a month, or a year. And so I have an interest in that information, and the government needs a warrant to be able to obtain it. But the entity that actually has that cell information might be Verizon, or AT&T. And so there's a difficulty in me actually understanding that the government is after that information, right, and being able to serve the need for a warrant.
Michael: That’s exactly right. And the court was very cognizant, in the Carpenter case about how sensitive this location information is. In Carpenter itself, the request spanned many months, and it provided over 12,000 data points. And the court observed that this provides an intimate window into somebody's life, and had quoted an earlier opinion that indicated that all of the movements, in their totality, could show a person's familial, political, professional, religious and sexual associations, and having the government be able to get that information just because it's relevant to an investigation posed a threat to privacy. That's where Carpenter came down.
Paras: In some of these instances, a Fourth Amendment interest is not intuitive. So what has the court defined as what is required to actually have an interest in privacy that's sufficient to raise Fourth Amendment concerns?
Michael: The court has articulated two different ways of looking at when somebody has a Fourth Amendment interest. The Fourth Amendment guards against unreasonable searches or seizures, but it doesn't tell the world what is reasonable or unreasonable. To solve that puzzle, you'd have to look back to how the court dealt with early communications over telephones.
Originally, the court did not see any privacy interest in a telephone communication between two people. It only regarded there as being a privacy interest that's protected by the Fourth Amendment if there was an invasion of property, planting a microphone in somebody's house. But later in a famous case in the sixties, called Katz v. United States, the government attached a device to the outside of a phone booth and recorded one side of a conversation. When the case went up to the Supreme Court, the court endorsed Katz's theory that he had a Fourth Amendment right not to be eavesdropped on in that way. And the Court adopted a test that says this:When an individual seeks to preserve something as private, even in a public place, his expectation of privacy will be protected by the Constitution when society is prepared to recognize it as reasonable. And that test, when society is prepared to recognize it as reasonable, cashes out as when five justices think that expectation is reasonable.
And so over time, the court has elaborated on Katz to hold that various things are reasonable and various things aren't not reasonable. For example, the court has said that one does not have a reasonable expectation of privacy in the checks that you write on a bank or other financial transactions through a bank. Why? Because the bank knows about them, and they are standard commercial transactions that contemplate that a third party will get the funds. Similarly, it said that the numbers that one dials on a telephone are not subject to a reasonable expectation of privacy, because the telephone company knows the numbers.
That was actually the foundation of the government's argument in Carpenter. The telephone company gets the information about cell signal location, because that's how it's going to connect to call. And everybody who uses a cell phone knows that the cell phone can only find you if you are in range of a cell tower, bringing to mind the famous Verizon phrase, can you hear me now? But the Court drew a line between cell-site information and telephone records of dialed numbers, because it thought that there was much more depth and revealing character in the sum of somebody's locational movements over a period of time than the phone numbers that they dial.
Now an interesting thing is, when I was getting ready for the Carpenter argument and talking to federal law enforcement agents about how they use cell-site information in an investigation, one of them told me that if he had a choice between cell-site information, and somebody's dialed phone numbers, he'd always start with the dialed phone numbers, because that tells you who somebody is connected to, and it opens up worlds of investigatory leads. But the court did not see it that way.
Paras: Carpenter was about a really narrow set of information, the cell tower location information. But has it been extended to other cases? What are the stakes that are really at play here when we talk about these privacy interests?
Michael: Well, the stakes are both high and uncertain. Carpenter itself noted that it was not resolving a lot of other technological questions in which privacy interests could be raised. Carpenter involved historical cell-site information, looking back over the past, but the government is able to get orders that require cell companies to provide real time, cell-site information so it can track a person as the person is going about their activities in real time.
The court didn't decide how Carpenter played out there. It also didn't decide other conventional surveillance techniques, such as security cameras. And it left open questions that are raised by modern and more sophisticated forms of requests, notably, geofence warrants, IP address requests, collections of energy utility data. And I think it's worth noting that, in addition to all of those uncertain areas, artificial intelligence is opening up vast new realms where private data is collected in the in the hands of companies, and the government may seek to use it for investigative purposes.
Paras: Michael, you talked about geofence warrants as one area of uncertainty. But what are other areas?
Michael: One of the prominent areas that's come up in litigation are pole cameras. These are cameras that the government installs on a utility pole, outside of somebody's house in order to monitor the comings and goings of people to the house. It's an incredibly powerful investigative lead. If, for example, you're investigating a drug trafficking organization, and you want to see who is coming to the house to deliver drugs or who is leaving the house with the drugs.
So the pole camera goes up. It has features that allow it to zoom and pan. It can focus on areas that would not be visible from a street, because it could see over bushes, or through tree canopies. And courts have wrestled with whether that's the kind of private information that Carpenter ought to protect, or whether it's simply a fact of life that anybody could sit outside your house and watch who's coming to your front door. and that's not private information because of a private person can do it so can the police.
This leads to a really interesting analogy that Justice Alito used in a case that the court heard earlier before Carpenter called United States vs. Jones. That was a case about attaching a GPS tracker to the underside of a car and monitoring where the car went. And the court ultimately said that doing that for four weeks was a Fourth Amendment search, but it relied on a property rationale rather than a privacy rationale. The court basically said, people do not expect in our society that their property will be made the objects of a government search without their consent, and attaching the GPS device to the bottom of the car was an intrusion on their property rights. So the court in Jones said that the GPS surveillance was bad, but it didn't have to confront this question about whether people have an expectation of privacy in their movements.
Justice Alito wrote a separate opinion in which he said they do, because if you look back to the early constitutional history in 1791, you couldn't have had a person conduct the kind of surveillance that a GPS device does. And he posited a law enforcement officer hiding on the bottom of a carriage, and he said that law enforcement officer would either have to be very, very small or have tremendous fortitude to hang on to the back of the carriage. So that's the kind of analogies that the court is working with in order to develop this area of how concepts that were developed by the founders in the 18th century translate to a very different informational environment that we have today.
Paras: That’s quite an image that Justice Alito painted there.
Michael: It is, indeed. I've often thought about that officer with great fortitude hanging on to the back of a carriage for a month at a time.
Paras: So if I'm a user of any of this type of technology, if I use social media or sending email or using my cell phone, what should I be concerned about here?
Michael: I think with email, the concerns are limited, because the court signaled, and the government has agreed, that email is virtually equivalent to private letters, which are protected by interests that the Constitution recognizes. So the government will get a warrant when it seeks to acquire email from a provider.
But in many of the other contexts in which the government is seeking information, its incentives are to say that Carpenter does not apply, and the problem that comes up is the person who has an incentive to say that Carpenter does apply doesn't know that the warrant has been issued, and that's because the Stored Communications Act — the fundamental law that governs this area — has a provision that allows the government to get a court order that requires the provider not to tell the user about the request. And there are good reasons for that. People who get notice of a criminal investigation may seek to intimidate or threaten witnesses, they may destroy evidence, they may flee, they may coordinate with other parties to obstruct justice. And the government has those concerns in mind when it is engaged in many criminal investigations. There can actually be threats of safety to individuals.
So, the law provides for the government to keep the information from the user. But that means that no one is standing up to the government and saying, look, you can't do this without getting a search warrant. And the idea behind a search warrant is it limits the scope of what the government can get, because it has to describe particularly what it's after, and it has to show probable cause to a neutral judge. And those are very profound and fundamental protections that are lost if no one is able to stand up to the government and say, you can't get this information based on simply asking for it.
Paras: How much should we be worried about the government acquiring this information versus other actors in the sector that users are engaging with?
Michael: This isn't a central point about our current data economy. Vast amount of information are in the hands of large and very influential companies that use the information for advertising, for development of products, for improvement of their own products, and that often sell the information to data brokers usually in an anonymized fashion, but in ways that promote use by deep analysis for a variety of commercial purposes.
And one of the issues that we didn't touch on in the article, but that lies right outside the periphery of the scope of the Fourth Amendment, is what happens when the government just goes into the marketplace and buys data from data brokers? The earlier question that we had about the police being able to observe whatever a citizen could observe, and the Fourth Amendment doesn't protect things that are out in public in that way, has been applied to the government's purchase of information from data brokers, the thinking being that if any American corporation or private user can buy that data and use it, why should the government be in a different place from the commercial purchasers?
But that means that the reach of the Constitution is starkly confined. So when I had a discussion recently with someone about, “Who do you think we should be more worried about? the government, in its acquisition of vast amounts of data about us, or private companies, which are scooping up that data when we interact with websites, the apps that are on our phone and so forth?" The person said to me, “Both,” and since the person was my wife, I thought that that was a very wise and insightful answer.
Paras: Another complication here is tackling this issue at the point when the government seeks the warrant is better than waiting until the search has actually happened, until the government has gone to a third party and obtain this information and then seeks to use it in a criminal trial. Why is that the case?
Michael: That’s true for a number of reasons, Paras. One is that the remedies after the fact don't protect the underlying privacy interest. The idea behind the Fourth Amendment is to limit arbitrary government action that intrudes on the privacies of life, and at a high level, that interest is gone once the government gets the information.
What happens is there are two mechanisms that are typically used to litigate after the fact whether the government violated the Fourth Amendment. One of them is a motion to suppress evidence in a criminal case, the other one is an action for damages against the officials who conducted the alleged search or seizure, and that can be state officials or federal officials. But both of those remedies are highly limited, because there are strong competing governmental interests at stake. In a suppression context, the court has warned against losing evidence that could prove guilt of crimes that society has decided to charge, and so there are many reasons why evidence will not be suppressed in a criminal case, apart from whether the Constitution was violated. And in damages actions, officials have what's called qualified immunity, which means that unless they have violated clearly established constitutional law, they are not responsible to pay damages to the person whose rights are violated. These mechanisms stunt the development of the underlying constitutional principles. A far better way to protect the Fourth Amendment would be to have those principles decided before the government gets the information at all.
Paras: Right, and those types of actions against officials are also just so difficult to bring, the bar there is so high. So even if you're able to bring a case, it would be really difficult to get relief because of that qualified immunity issue. What have we seen from tech companies in this space? Do they comply with these requests for third party data or have they fought back?
Michael: There’s some history of tech companies showing resistance to what are regarded as over-broad requests for information. And some of that has been public. Apple, for example, notably resisted the government's efforts to try to get it to break into an iPhone after the San Bernardino mass shooting, on the ground that creating the tool that would allow the government to get into the iPhone would compromise everybody's security and privacy.
Other tech companies have pushed back on what I referred to earlier as geofence warrants. These are novel warrants that allow the government to collect information about every cell phone in a narrow geographic area. And the reason the government wants to do that is if it knows that a crime has occurred, and it doesn't have a suspect, the movement of cell phones in and around the criminal crime scene can reveal a lot about who potentially is implicated in the crime. At the same time, by necessity, a geofence warrant has the potential to acquire vast amounts of information about innocent people who are simply traveling through the area, and may have been traveling for very private reasons, such as visiting a medical clinic or seeing a person for political reasons that they did not want to have revealed to the government.
So Google in particular has crafted a three part showing that the government must make to get progressively more granular detail about the individuals who are in a particular geographical location when the government comes calling with a geofence warrant. But these are just the tip of the iceberg. Most of this litigation takes place under seal because it involves sensitive criminal investigations. and the extent of company pushback and court agreement with the limitations that companies might seek is not well known.
Paras: Right. So we don't want to have to rely on these third parties to assert these rights on behalf of a user, and in some cases, like with law firms, courts have actually found that there isn't a Fourth Amendment interest. Can you tell us about the recent Covington and Burling case?
Michael: Yes, in the Covington and Burling case, the SEC was investigating a hack of a major law firm’s servers that disclosed potentially multiple clients’ sensitive data. And the SEC was of course interested to see whether somebody had hacked into it and then use that information to commit securities law violations, such as insider trading.
Covington and Burling sought to resist the SEC’s request, and it cited Carpenter in an effort to protect its private relationship with the clients whose information was at question. And the court brushed that aside and said Carpenter doesn't extend that far, there is no Fourth Amendment protected interest in simply having a client relationship. But it narrowed the subpoena considerably and just this week, Covington and Burling and the SEC reached an agreement in which the SEC will get information about six of the seven clients that it wanted to investigate. The seventh has indicated that it intends to appeal.
So that case actually illustrates exactly the paradox that I was talking about. Covington really didn't have standing to assert some of the claims that might belong to its client. In that case, the clients knew about the investigation, because there weren't the kinds of interests of jeopardizing the integrity of judicial proceedings or the government's criminal investigation that would warrant a gag order. But in the typical criminal case, the company does not have standing, namely a legally recognized right, in the private information that the government wants, and the user has no idea that the government is asking for that information.
Paras: What’s the solution here that you propose?
Michael: I wrote this article in collaboration with my Georgetown research assistants, Conor O'Shea, Johanna Seale, and Liz Hadley, and the four of us took a deep dive into the way Carpenter has been interpreted and frustrations in the current law for getting these issues decided. Our solution is that Congress should enact a statute that provides in particular circumstances, the right of a company to go to court and raise the Fourth Amendment claims that the users have that cannot raise themselves because they are unaware of the action.
Paras: Michael, that image that Justice Alito brought up raises a question for me, which is, how equipped is the court to really grapple with these questions of evolving technology?
Michael: It's a great question, because the court is well aware of both its responsibility to answer these questions, and its limited ability to do so. Take, for example, a case that the court heard last term about Section 230 of the Communications Decency Act. That statute provides protection to internet platforms that host third party speech and basically relieves them of liability for the content of third party communications that they host and provide. The question was how far that statute reached. And the court was concerned in hearing the case about whether 230 was vital to the development of the Internet, and if it was cut back, it would curtail it, or whether Section 230 had been extended too far.
And Justice Kagan remarked during the argument, “We really don't know what's going to happen. These nine people” — she gestured to the court —- “are not the world's greatest experts on the Internet." And everybody laughed. But there's a underlying truth there. The court has to struggle to understand both the scope of modern technology and its impact on constitutional rights, and where the principles announced today will land in the near and distant future as technology evolves. And the court oscillates between saying, look, we have to take the long view and try to come up with principles that will address evolving technology, not just technology today, and being more restrained and modest and stepping back, and refraining from exercising all of the constitutional power that it has to define the Fourth Amendment, because it doesn't know what the impact of that will be.
In the main, the court is a phenomenal organization, a phenomenal institution for acquiring information. It gets that through amicus briefs, and then it sifts through the legal tests that have been developed in past cases, and it comes up with principles that have a tremendous amount of strength, in certain instances, if it has a firm grasp on the relationship between the law and the new fact situation. When it doesn't have as firm grasp on that, then the principles can quickly become outmoded, or come into conflict with each other.
Paras: Michael, this has been such a rich and helpful discussion, these issues have a long tail and we'll be watching them at Just Security. Thanks so much for joining the show.
Michael: Thanks so much for having me.
Paras: This episode was hosted by me, Paras Shah. It was edited and produced by Tiffany Chang, Michelle Eigenheer, and Clara Apt. Our theme song is “The Parade” by Hey Pluto.
Special thanks to Michael Dreeben. You can read Michael’s two-part analysis of Carpenter’s third-party paradox on our website. If you enjoyed this episode, please give us a five star rating on Apple Podcasts or wherever you listen.