Supremes to Congress: Bring privacy law into 21st century

<b style="color:#900;">commentary</b> The justices have ruled that GPS tracking requires a warrant. Now Congress needs to act to balance privacy and public safety regarding location data.

Berin Szoka Charlie Kennedy
Berin Szoka
Berin Szoka is president of TechFreedom, a Washington-based tech policy think tank that launched in 2011. He was formerly a senior fellow at The Progress & Freedom Foundation, where he directed PFF's Center for Internet Freedom.
Charlie Kennedy
Charlie Kennedy is a TechFreedom senior adjunct fellow, a partner at Wilkinson Barker Knauer, and a longtime adjunct professor at Catholic University Law School.
5 min read
Editors' note: This is a guest column. See bios of Berin Szoka and Charlie Kennedy below.

Last week's unanimous decision of the Supreme Court in U.S. v. Jones (PDF) marks a major victory for constitutional rights.

While the justices split in their rationale, they agreed that protecting Americans' privacy in the digital age will require the Court to do a great deal more to untangle its confusing Fourth Amendment jurisprudence. That will likely take several more decisions -- and many years. Meanwhile, Congress should heed Justice Samuel Alito's call for legislation limiting government's ability to track us and snoop through our private communications.

First, the good news: Law enforcement can no longer plant GPS tracking devices on our vehicles without satisfying the Fourth Amendment. Even better: the majority of justices -- including conservative Justices Antonin Scalia, John Roberts, Anthony Kennedy, and Clarence Thomas, joined by Obama appointee Sonia Sotomayor -- agreed that Jones is only the beginning of the long-overdue inquiry into constitutional protections against location-based surveillance.

In a way, Jones was an easy case: By recognizing that law enforcement's physical trespass on private property to plant a surveillance device constituted a search, the Court ensured that the Fourth Amendment provides at least as much privacy protection today as when it was adopted.

Just as the Fourth Amendment would have been triggered if an 18th century constable hid himself in a suspect's stagecoach to track him or record his conversations, so too must modern police satisfy the Fourth Amendment before using satellites to track devices hidden on cars. (Whether the Constitution required a probable cause warrant or would have been satisfied by some lesser standard, such as reasonable suspicion, the Jones majority did not decide.) But what about purely electronic surveillance?

Where no trespass occurs, the Court in Jones reiterated that, under its 1967 decision in U.S. v. Katz, the relevant question is whether government's surveillance violated a reasonable expectation of privacy. Unfortunately, the Court offered no definitive guidance as to when location-based surveillance would meet this "reasonable expectation of privacy" standard. The majority sidestepped the issue by focusing on trespass, but suggested (reluctantly) that in future nontrespass surveillance cases, determining reasonableness could require balancing of such factors as length of surveillance and the seriousness of the crime under investigation. Four of the concurring justices went further, declaring that short-term monitoring not accompanied by trespass would not violate a surveillance target's reasonable expectation of privacy.

For civil libertarians looking ahead to future Fourth Amendment battles, these confusing signals are hardly reassuring. But there is some comfort in Justice Sotomayor's separate concurrence, boldly recalling the Fourth Amendment's goal: to "curb arbitrary exercises of police power and to prevent 'a too permeating police surveillance.'" Sotomayor opened the door to fundamentally rethinking the Katz test -- or at least, its most pernicious result: the third-party doctrine.

The Court has in the past held that, as soon as you share information with any third party, you've given up any "expectation" of privacy. Thus, while the Fourth Amendment applies to digital files on your computer, it may not protect the same file stored on Dropbox or in your Gmail.

Sotomayor denounced the third-party doctrine as "ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks." Technological evolution requires that "Fourth Amendment jurisprudence ceases to treat secrecy as a prerequisite for privacy," she rightly declared. While Sotomayor didn't say it outright, she seems to be hinting at what the Cato Institute argued in their excellent amicus brief in this case: the Court has fundamentally misinterpreted Katz. In fact, the "reasonable expectation" standard actually comes from Justice Harlan's solo concurrence in that case. Justice Stewart's majority opinion, joined by six justices, used a different standard:

What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.

In other words, as Cato argues, Katz really hinges on "physical and legal access to information rather than anyone's feelings about privacy" -- meaning "a 'search' has occurred when technological enhancement takes what the government observes far beyond what is ordinarily accessible [to law enforcement]." Clarifying the Katz standard would kill two birds with one stone: An accessibility standard would properly restore the presumption that surveillance requires a warrant and thus prevent privacy protections from lagging so far behind the evolution of electronic surveillance. It would also end the third-party doctrine's absurd online/offline distinction.

The Court might or might not bring its Fourth Amendment jurisprudence into the 21st century, but Congress shouldn't wait. Congress needs to act immediately "to draw detailed lines, and to balance privacy and public safety in a comprehensive way," as Justice Alito urged. Congress has never protected location data, but in 1986 attempted to protect data remotely stored with "third parties." That law, the Electronic Communications Privacy Act, is a byzantine mess of outdated standards for determining when a warrant is and isn't required.

So Congress needs to amend ECPA to ensure that a warrant is required for location data and for stored content regardless of how long it's been held or whether it's been opened. These are two of the four core principles agreed on by the Digital Due Process Coalition, a philosophically diverse alliance of advocacy organizations and legal scholars, joined by dozens of leading technology companies and trade associations. Sen. Leahy (D-Vt.), ECPA's original author, has proposed to fix ECPA's inconsistent content protections while Sen. Ron Wyden (D-Ore.), Sen. Mark Kirk (R-Ill.) and Rep. Jason Chaffetz (R-Utah) have proposed to protect location data.

By signing the "Not Without a Warrant" petition, you can support this bipartisan effort to the bring the Fourth Amendment into the digital age -- by giving law enforcement access to private information only when courts determine they have established probable cause to believe that a crime has been committed or is about to be committed. That requirement is the crown jewel of our civil rights, and so long as the Court doesn't protect it, Congress must.

Correction, January 31 at 12:20 p.m. PT: Patrick Leahy is a Democratic senator from Vermont. The story originally misidentified the state he represents.