Want CNET to notify you of price drops and the latest stories?

Senator pushes for mobile privacy reform

Draft bill from Sen. Ron Wyden reviewed by CNET would establish privacy protections for mobile devices and regulate police use of GPS bugs.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
6 min read

Draft legislation would provide new privacy protections for Americans by requiring police to obtain search warrants to track the locations of cars and cell phones.

The forthcoming bill being prepared by Sen. Ron Wyden (D-Oregon) and reviewed by CNET would provide legal protections for "geolocation information," meaning data that can locate a person through a wireless device or through a GPS tracker placed on a vehicle.

Even though police are tapping into the locations of mobile phones and implanting GPS bugs thousands of times a year, the legal ground rules remain unclear, and federal privacy laws written a generation ago are ambiguous at best. Courts have split over how easy it should be for police to track Americans electronically, and whether the same rules should apply to live tracking and obtaining stored information about someone's earlier whereabouts.

U.S. Sen. Ron Wyden U.S. Senate

"I think that a lot of people have not really put their arms around the dimensions of this, the fact that everybody's got a handheld electronic device, a cell phone, a GPS system," Wyden, who has become the Senate's leading champion of electronic privacy, said in a recent interview. "Everybody's carrying them around everywhere and probably aren't thinking that much about the fact that someone may be keeping tabs on them."

His proposal--currently being called the Geolocational Privacy and Surveillance Act, or GPS Act--is likely to encounter strong support from Internet companies, civil libertarians, and wireless carriers, many of which have joined a coalition saying location information should be accessed "only with a warrant." Law enforcement opposition, on the other hand, could be significant.

The Obama Justice Department has argued in court that warrantless tracking should be permitted because Americans enjoy no "reasonable expectation of privacy" in their--or at least their cell phones'--previous locations. And an agent in the Tennessee Bureau of Investigation told Congress last year that requiring a search warrant before tracking criminals "will have a significant slowing effect on the processing of child exploitation leads."

Wyden's GPS Act says that, in general, it's illegal to track someone wirelessly except with a warrant signed by a judge, permission of the Foreign Intelligence Surveillance Court, or during an emergency situation. Prior consent to being tracked is another exception, of course, and it's also legal to snoop on the location of someone who stole your wireless device (or car, for that matter).

"It's really up to Congress to step in and provide clear rules for both the government and companies and judges that are faced with these issues," Kevin Bankston, a senior staff attorney at the Electronic Frontier Foundation in San Francisco who works on electronic privacy topics, said yesterday. "That's the only way to bring the necessary clarity to the location privacy situation."

A spokeswoman for Wyden said yesterday that she doesn't have a timeline for when the final legislation will be introduced. Wyden has previously said he's in discussions with Rep. Jason Chaffetz, a Utah Republican, about sponsoring a companion measure in the House of Representatives.

The Justice Department did not respond to a request for comment.

One portion of the GPS Act that's likely to cheer privacy advocates limits the use of intercepted geolocation information in court unless proper procedures were followed. Another allows someone whose location data were "intercepted, disclosed, or intentionally used in violation of" the law to file a civil lawsuit and recover actual damages or $10,000 in statutory damages.

In an echo of the debate over the Foreign Intelligence Surveillance Act, Wyden's proposal says "no person may acquire the geolocation information of a person" for "law enforcement or intelligence purposes except pursuant to a warrant" or through the other procedures spelled out in the draft.

"It's a smart proposal," says Marc Rotenberg, director of the Electronic Privacy Information Center in Washington, D.C. "The federal wiretap law should be updated to take account of new transactional data. There is clearly a privacy interest in locational data and there is also a need for greater clarity."

Not long ago, the concept of tracking cell phones would have been the stuff of spy movies. In 1998's "Enemy of the State," Gene Hackman warned that the National Security Agency has "been in bed with the entire telecommunications industry since the '40s--they've infected everything." But after a decade of appearances in popular TV shows and movies such as "24" and "Live Free or Die Hard," location-tracking has become such a trope that it was satirized in a scene with Seth Rogen in the 2008 movie "Pineapple Express."

Whether state and federal police have been paying attention to Hollywood, or whether it was the other way around, cell phone tracking has become a regular feature in criminal investigations. It comes in two forms: police obtaining retrospective data kept by mobile providers for their own billing purposes that may not be very detailed, or prospective data that reveals the minute-by-minute location of a handset or mobile device. GPS tracking, too, has become commonplace, with courts reaching different conclusions about what procedures should be followed.

CNET was the first to report on prospective cell tracking in a 2005 news article. In a subsequent Arizona case, agents from the Drug Enforcement Administration tracked a tractor trailer with a drug shipment through a GPS-equipped Nextel phone owned by the suspect. Texas DEA agents have used cell site information in real time to locate a Chrysler 300M driving from Rio Grande City to a ranch about 50 miles away. Verizon Wireless and T-Mobile logs showing the location of mobile phones at the time calls were made became evidence in a Los Angeles murder trial.

The way tracking works is simple: mobile phones are miniature radio transmitters and receivers. A cellular tower knows the general direction of a mobile phone (many cell sites have three antennas pointing in different directions), and if the phone is talking to multiple towers, triangulation yields a rough location fix. With this method, accuracy depends in part on the density of cell sites.

The Federal Communications Commission's Enhanced 911 (E911) requirements allowed rough estimates to be transformed into precise coordinates. Wireless carriers using CDMA networks, such as Verizon Wireless and Sprint Nextel, tend to use embedded GPS technology to fulfill E911 requirements. AT&T and T-Mobile comply with E911 regulations using network-based technology that computes a phone's location using signal analysis and triangulation between towers.

A 2008 court order to T-Mobile in a criminal investigation of a marriage fraud scheme, which was originally sealed and later made public, says: "T-Mobile shall disclose at such intervals and times as directed by (the Department of Homeland Security), latitude and longitude data that establishes the approximate positions of the Subject Wireless Telephone, by unobtrusively initiating a signal on its network that will enable it to determine the locations of the Subject Wireless Telephone."

Cellular providers tend not to retain moment-by-moment logs of when each mobile device contacts the tower, in part because there's no business reason to store the data, and also because of storage costs. They do, however, keep records of what tower is in use when a call is initiated or answered--and those records are generally stored for six months to a year, depending on the company. (A Verizon official said last year the company keeps phone records including cell site location for 12 months.)

In September, a federal appeals court in Philadelphia handed down a decision that did not resolve when cell phone tracking is permissible under the Fourth Amendment. EFF and the ACLU are currently litigating another case (PDF) in Texas over whether existing federal law provides judges with enough autonomy to require search warrants for historical cellular location data.