Geo-privacy bills aim to curb warrantless tracking

WASHINGTON--Police would no longer be able to conduct warrantless surveillance of Americans' whereabouts, according to legislation introduced today that would require search warrants to monitor the locations of cars or mobile devices.

Bills drafted by Sen. Ron Wyden (D-Ore.) and Rep. Jason Chaffetz (R-Utah) provides new legal protections for "geolocation information," meaning data that can locate a person through a wireless device or a GPS tracker placed on a vehicle. In March, CNET was the first to report on an earlier draft of the measure.

These rules "will foster the effective use of geolocation data while protecting the privacy rights of law-abiding American citizens," Wyden said. (See a Q&A with Wyden from earlier this year.)

Chaffetz told CNET on Monday after a dinner organized by the Electronic Privacy Information Center that he was optimistic about the House of Representatives leadership aiding the sometimes-tricky process of moving the bill (PDF) to a floor vote. The companion bills were introduced in both chambers of Congress.

Even though police are tapping into the locations of mobile phones and planting GPS bugs on vehicles thousands of times a year, the legal ground rules remain unclear, and federal privacy laws written a generation ago are ambiguous at best. Courts have split over how easy it should be for police to track Americans electronically and whether the same rules should apply to live tracking and obtaining stored information about someone's earlier whereabouts.

The Wyden-Chaffetz proposal--called the Geolocational Privacy and Surveillance Act, or GPS Act--is already encountering strong support from civil libertarians. They're likely to be joined by corporate members of a coalition, including Google, AT&T, and Microsoft, which has adopted a principle saying location information should be accessed "only with a warrant." The Computer and Communications Industry Association, which includes Google and Sprint as members, said it "would provide new legal clarity for businesses facing various law enforcement requests for customer data."

Law enforcement opposition, on the other hand, could be significant. In April, the Obama Justice Department launched a frontal attack on the idea of requiring search warrants for locations, with James Baker, the associate deputy attorney general, telling a Senate panel that such a requirement would hinder "the government's ability to obtain important information in investigations of serious crimes." Previously, the department had argued in court that warrantless tracking should be permitted because Americans enjoy no "reasonable expectation of privacy" in their, or at least their cell phones', previous locations.

The Wyden-Chaffetz GPS Act says that, in general, it's illegal to track someone wirelessly except with a warrant signed by a judge, permission of the Foreign Intelligence Surveillance Court, or during an emergency situation. That goes further than another bill, the Electronic Communications Privacy Act Amendments Act of 2011 (PDF), recently introduced by Sen. Patrick Leahy (D-Vt.), which doesn't require police to obtain a search warrant to peruse your previous whereabouts obtained by tracking your cell phone.

Under the GPS Act, prior consent to being tracked is another exception, and it's also legal to snoop on the location of someone who stole your wireless device (or car, for that matter). A second section limits the use of intercepted geolocation information in court unless proper procedures were followed. Another allows someone whose location data were "intercepted, disclosed, or intentionally used in violation of" the law to file a civil lawsuit and recover actual damages or $10,000 in statutory damages.

Compared with earlier versions of the GPS Act, the final draft is slimmer, down to 20 pages from 29. Absent are pages of regulations dealing with foreign intelligence location collection.

Not long ago, the concept of tracking cell phones would have been the stuff of spy movies. In 1998's "Enemy of the State," Gene Hackman warned that the National Security Agency has "been in bed with the entire telecommunications industry since the '40s--they've infected everything." But after a decade of appearances in the likes of "24" and "Live Free or Die Hard," location-tracking has become such a trope that it was satirized in a scene with Seth Rogen in "Pineapple Express" (2008).

Whether state and federal police have been paying attention to Hollywood, or whether it was the other way around, cell phone tracking has become a regular feature in criminal investigations. It comes in two forms: police obtaining retrospective data kept by mobile providers for their own billing purposes that may not be very detailed, or prospective data that reveals the minute-by-minute location of a handset or mobile device. GPS tracking, too, has become popular, with courts reaching different conclusions about what procedures should be followed.

CNET was the first to report on prospective cell tracking in a 2005 news article. In a subsequent Arizona case, agents from the Drug Enforcement Administration tracked a tractor trailer with a drug shipment through a GPS-equipped Nextel phone owned by the suspect. Texas DEA agents have used cell site information in real time to locate a Chrysler 300M driving from Rio Grande City to a ranch about 50 miles away. Verizon Wireless and T-Mobile logs showing the location of mobile phones at the time calls became evidence in a Los Angeles murder trial.

The way tracking works is simple: mobile phones are miniature radio transmitters and receivers. A cellular tower knows the general direction of a mobile phone (many cell sites have three antennas pointing in different directions), and if the phone is talking to multiple towers, triangulation yields a rough location fix. With this method, accuracy depends in part on the density of cell sites.

The Federal Communications Commission's "Enhanced 911" (E911) requirements allowed rough estimates to be transformed into precise coordinates. Wireless carriers using CDMA networks, such as Verizon Wireless and Sprint Nextel, tend to use embedded GPS technology to fulfill E911 requirements. AT&T and T-Mobile comply with E911 regulations using network-based technology that computes a phone's location using signal analysis and triangulation among towers.

A 2008 court order to T-Mobile in a criminal investigation of a marriage fraud scheme, which was originally sealed and later made public, says: "T-Mobile shall disclose at such intervals and times as directed by (the Department of Homeland Security), latitude and longitude data that establishes the approximate positions of the Subject Wireless Telephone, by unobtrusively initiating a signal on its network that will enable it to determine the locations of the Subject Wireless Telephone."

Cellular providers tend not to retain moment-by-moment logs of when each mobile device contacts the tower, in part because there's no business reason to store the data, and also because of storage costs. They do, however, keep records of what tower is in use when a call is initiated or answered--and those records are generally stored for six months to a year, depending on the company. (A Verizon official said last year the company keeps phone records including cell site location for 12 months.)

In September, a federal appeals court in Philadelphia handed down a decision that did not resolve when cell phone tracking is permissible under the Fourth Amendment. The Electronic Frontier Foundation and the ACLU are currently litigating another case (PDF) in Texas over whether existing federal law provides judges with enough autonomy to require search warrants for historical cellular location data.

Also today, Sens. Al Franken (D-Minn.) and Richard Blumenthal (D-Conn.) introduced a bill called the Location Privacy Protection Act of 2011, which aims to curb commercial use of geolocation data.