Does a more careful reading of the Supreme Court’s decision in U.S. v. Jones turn up a lurking victory for the government?

Modern media moves so fast that the second-day story happens in the afternoon of the first. The Supreme Court ruled unanimously Monday morning that government agents conduct a Fourth Amendment search when they place a GPS device on a private vehicle and use it to monitor a suspect’s whereabouts for weeks at a time. Monday afternoon, a couple of commentators suggested that the case is less a win than many thought because it didn’t explicitly rule that a warrant is required to attach a GPS device to a vehicle.

Writing on the Volokh Conspiracy blog, George Washington University law professor Orin Kerr noted “What Jones Does Not Hold.”

The Court declined to reach when the installation of the device is reasonable or unreasonable. … So we actually don’t yet know if a warrant is required to install a GPS device; we just know that the installation of the device is a Fourth Amendment “search.”

And over on Scotusblog, Tom Goldstein found that “The Government Fared Much Better Than Everyone Realizes“:

[D]oes the “search” caused by installing a GPS device require a warrant? The answer may be no, given that no member of the Court squarely concludes it does and four members of the Court (those who join the Alito concurrence) do not believe it constitutes a search at all.

So there is a constitutional search when the government attaches a GPS device to a vehicle, but the Court conspicuously declined to say that such a search requires a warrant. Do we have an “a-ha” moment?

When the Supreme Court granted certiorari in the case, it took the unusual step of adding to the questions it wanted addressed. In addition to “[w]hether the warrantless use of a tracking device on respondent’s vehicle to monitor its movements on public streets violated the Fourth Amendment,” the Court wanted to know “whether the government violated respondent’s Fourth Amendment rights by installing the GPS tracking device on his vehicle without a valid warrant and without his consent.” These are both compound questions, but the dimension added by the second is the Fourth Amendment meaning of attaching a device to a vehicle. The case was about attaching a device to a vehicle, and if the Court didn’t walk through every clause in each of the questions presented, that’s why.

On that central question in the case, the government argued the following: “Attaching the GPS tracking device to respondent’s vehicle was not a search or seizure under the Fourth Amendment.” The government lost, full stop.

Now, it’s true that the Court’s majority opinion didn’t explictly find that the “search” that occurs when attaching and using a GPS device requires a warrant, but look at its characterization of the opinion it affirmed: “The United States Court of Appeals for the District of Columbia Circuit reversed [Jones's] conviction because of admission of the evidence obtained by warrantless use of the GPS device which, it said, violated the Fourth Amendment.”

The Court did decline to consider the argument that the government might be able to attach a device based on reasonable suspicion or probable cause—that argument was “forfeited” by the government’s failure to raise it in the lower courts—but if the Supreme Court were limiting its holding to the attachment-as-search issue, it would have remanded the case back to the lower courts for further proceedings consistent with the opinion. It did not, and the sensible inference to draw from that is that the general rule applies: a warrant is required in the absence of one of the customary exceptions. Failing to make that explicit was not “opening a door” to a latent government victory. U.S. v. Jones was a unanimous decision rejecting the government’s warrantless use of outré technology to defeat the natural privacy protections provided by law and physics.

At least one serious lawyer I know has raised the point that I address here, and it is a real one, but some in the commentariat are a little too showy with their analysis and far too willing to go looking for a government victory in what is nothing other than a government defeat.

The Second-Day Story on U.S. v. Jones is a post from Cato @ Liberty - Cato Institute Blog

The Supreme Court has delivered a big win for privacy in U.S. v. Jones. That’s the case in which government agents placed a GPS device on a car and used it to track a person round-the-clock for four weeks. The question before the Court was whether the government may do this in the absence of a valid warrant. All nine justices say No.

That’s big, important news. The Supreme Court will not allow developments in technology to outstrip constitutional protections the way it did in Olmstead.

Olmstead v. United States was a 1928 decision in which the Court held that there was no Fourth Amendment search or seizure involved in wiretapping because law enforcement made “no entry of the houses or offices of the defendants.” It took 39 years for the Court to revisit that restrictive, property-based ruling and find that Fourth Amendment interests exist outside of buildings. “[T]he Fourth Amendment protects people, not places” went the famous line from Katz v. United States (1967), which has been the lodestar ever since.

For its good outcome, though, Katz has not served the Fourth Amendment and privacy very well. The Cato Institute’s brief argued to the Court that the doctrine arising from Katz “is weak as a rule for deciding cases.” As developed since 1967, “the ‘reasonable expectation of privacy’ test reverses the inquiry required by the Fourth Amendment and biases Fourth Amendment doctrine against privacy.”

Without rejecting Katz and reasonable expectations, the Jones majority returned to property rights as a basis for Fourth Amendment protection. “The Government physically occupied private property for the purpose of obtaining information” when it attached a GPS device to a private vehicle and used it to gather information. This was a search that the government could not conduct without a valid warrant.

The property rationale for deciding the case had the support of five justices, led by Justice Scalia. The other four justices would have used “reasonable expectations” to decide the same way, so they concurred in the judgement but not the decision. They found many flaws in the use of property and “18th-century tort law” to decide the case.

Justice Sotomayor was explicit in supporting both rationales for protecting privacy. With Justice Scalia, she argued, “When the Government physically invades personal property to gather information, a search occurs.” This language—more clear, and using the legal term of art “personal property,” which Justica Scalia did not—would seem to encompass objects like cell phones, the crucial tool we use today to collect, maintain, and transport our digital effects. Justice Sotomayor emphasized in her separate concurrence that the majority did not reject Katz and “reasonable expectations” in using property as the grounds for this decision.

Justice Sotomayor also deserves special notice for mentioning the pernicious third-party doctrine. “[I]t may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties.” The third-party doctrine cuts against our Fourth Amendment interests in information we share with ISPs, email service providers, financial services providers, and so on. Reconsidering it is very necessary.

Justice Alito’s concurrence is no ringing endorsement of the “reasonable expectation of privacy” test. But he and the justices joining him see many problems with applying Justice Scalia’s property rationale as they interpreted it.

Along with the Scalia-authored Kyllo decision of 2001, Jones is a break from precedent. It may seem like a return to the past, but it is also a return to a foundation on which privacy can be more secure.

More commentary here in the coming days and weeks will explore the case’s meaning more fully. Hopefully, more Supreme Court cases in coming years and decades will clarify and improve Fourth Amendment doctrine.

U.S. v. Jones: A Big Privacy Win is a post from Cato @ Liberty - Cato Institute Blog

That’s NYPD Commissioner Ray Kelly touting a new technology called “terahertz imaging detection” to a local news outlet.

Terahertz radiation is electromagnetic waves at the high end of the infrared band, just below the microwave band. The waves can penetrate a wide variety of non-conducting materials, such as clothing, paper, cardboard, wood, masonry, plastic, and ceramics, but they can’t penetrate metal or water. Thus, directing terahertz radiation at a person and capturing the waves that bounce off them can reveal what is under their clothes without the discomfort and danger of going “hands-on” in a search for weapons. Many materials have unique spectral “fingerprints” in the terahertz range, so terahertz imaging can be tuned to reveal only certain materials. (In case you’re wondering, I got this information off the top of my head…)

Will the machines be tuned to display only particular materials? Or will they display images of breasts, buttocks, and crotches? The TSA’s “strip-search machines” got the moniker they have because they did the latter—until the agency tardily re-configured them.

Then there’s the flip-side of not going “hands-on.” Terahertz imaging detection doesn’t natively reveal to the person being searched that law enforcement has picked him or her out for scrutiny. A pat-down certainly lets the individual know he or she is being searched, positioning one to observe and challenge one’s treatment as a suspect. Terahertz imaging lacks this natural—if insufficient—check on abuse.

So terahertz imaging is not just a “hi-tech pat-down.” Its potential takes what would be a pat-down and makes it into a secret, but intimate, visual examination—a surreptitious strip-search. Pat-downs and secret strip-searches are very different things, and it is not necessarily reasonable, where a pat-down might be called for, to use terahertz imaging.

And that brings us to the fundamental problem with Commissioner Kelly’s proffer to use this technology at a “specific event” or at a “shooting-prone location.” These contexts do not create the individualized suspicion that Fourth Amendment law demands when government agents are going to examine intimate details of a person’s body and concealed possessions.

It is certainly possible to devise a terahertz imaging device and a set of use protocols that are constitutional and appropriate for routine, domestic law enforcement, but Commissioner Kelly hasn’t thought of one, and I can’t either.

Consider the dollar costs and potential health effects of terahertz imaging detection, it might just be that the pat-downs pass muster far better than the high-tech gadgetry.

“You could use it at a specific event. You could use it at a shooting-prone location…” is a post from Cato @ Liberty - Cato Institute Blog

I attended the Supreme Court’s oral argument in U.S. v. Jones today, the case dealing with the Fourth Amendment constitutionality of using GPS to track individuals’ movements without a warrant. Predicting outcomes is fraught, and you’re getting your money’s worth from the following free observations.

It seemed to me that most members of the Court want to rule that the government does not have free reign to attach GPS devices to cars. Justices Kennedy, Breyer, and Sotomayor, for example, noted the vast consequences if the government were to win the case. Law enforcement could attach tracking devices to people’s overcoats, for example, and monitor their movements throughout society without implicating the Fourth Amendment. Voluble as he often is, Justice Scalia did not say that the Fourth Amendment doesn’t reach GPS because GPS data wasn’t around for the Framers to insulate from government access.

Justice Alito’s thinking seemed to venture the furthest. He noted how insufficient it would be if the Court were to decide the case based on the narrow ground that attaching a GPS device to a car is an unreasonable seizure. Doing so would not account for the vast amount of personal data the government might access without attaching something to a car, clothing, or other property. If not in this case, the Court will soon have to face the (pernicious) third-party doctrine, which holds that a person has no Fourth Amendment interests in information shared with others.

If the Court desires to rule against the government, the one thing it lacks is a rationale for doing so. When it was time for Jones’s counsel to argue, the Justices seemed frustrated not to have a principle on which to base a decision.

Justice Scalia early-on declared his concern with GPS tracking and his dismay that the “reasonable expectation of privacy” test from Katz v. United States (1967) might shrink the zone of privacy the Framers sought to protect in the Fourth Amendment. But he later retreated into a sort of catch-all posture: the Congress can control GPS tracking if it wants. (Jones’s counsel cleverly suggested that there were 535 reasons not to do that.)

Other Justices’ questions danced awkwardly with the “reasonable expectation of privacy” test. Justice Kennedy was equivocal once about whether it would apply. Chief Justice Roberts seemed acutely aware of the Court’s incompetence to make judgments of such broad societal sweep. This is for good reason: there is no way to determine what society thinks, or what is “reasonable” in terms of privacy, when new technologies are applied new ways.

The solution to this conundrum can be found in the Cato Institute’s amicus brief in the Jones case. The Court should not use the “reasonable expectation of privacy” test from Justice Harlan’s Katz concurrence. Rather, it should follow the majority holding, which accorded Fourth Amendment protection to information that Katz had kept private using physical and legal arrangements. The government stands in the same shoes as the general public when it comes to private information—that is, information that can’t be accessed legally or with ordinary perception. When the government accesses information that was otherwise private, those searches and seizures must be reasonable and must almost always be based upon a warrant.

This way of administering the Fourth Amendment is not a snap of the fingers. There will be details to hash out when the Court eventually finds that having a Fourth Amendment interest in information turns on a factual question: whether someone has concealed information about him- or herself.

The biggest impediment to adoption of this rule may be getting lawyers to realize that “reasonable expectation of” is not a prefix required every time they use the word “privacy.”

U.S. v. Jones: The Court’s Search for a Rationale is a post from Cato @ Liberty - Cato Institute Blog

If the government put a GPS monitor on your car and used it to track every vehicular movement of yours for four weeks, do you think that would violate your Fourth Amendment rights? The government would like to be able to do that kind of thing without getting a warrant, and the Supreme Court will soon decide whether it can.

On November 8th, the Court will hear oral argument in U.S. v. Jones. Yours truly was the lead author of Cato’s amicus brief in the case, which may have a significant effect on how Fourth Amendment law intersects with new information technologies for decades to come.

In 2004, suspecting that Antoine Jones was dealing drugs, the FBI secretly attached a GPS tracking device to his car without a valid warrant. The FBI used this device to monitor and record the car’s movements, noting its location every ten seconds when it was in motion, for nearly a month before finally arresting Jones. The U.S. Court of Appeals for the D.C. Circuit found that the FBI’s action was unconstitutional because it violated Jones’s “reasonable expectation of privacy”—the two-part Fourth Amendment standard developed in the landmark case of Katz v. United States. Though he traveled on public roads, the totality of his movements was available to nobody and thus was private.

Our brief argues that the government’s conversion of Jones’s vehicle into a surveillance device was an unreasonable seizure under the Fourth Amendment. Even though he didn’t lose a “possessory” interest in his car, the government invaded Jones’s various property rights, including the right to exclude, the right to manage, the right to use, and the right to the profits. Similarly, using his car to collect detailed data on his movements over this extended period without getting a warrant was an unreasonable search. The data reflecting his movements would never have come into existence without the government attaching its GPS device to his car. These are tough, interesting issues arising in the new circumstances created by information technology.

We spent as much time in the brief on the “reasonable expectations of privacy” test. The product of one Justice’s lone concurrence in the Katz case, it holds that if a person has an actual (subjective) expectation of privacy and that expectation is one society is prepared to accept, then the Fourth Amendment protects the object of that expectation.

Courts have never faithfully applied this test, and for good reason: it’s a doctrinal mess that reverses the Fourth Amendment’s focus. Courts have second-guessed what the citizenry thinks in terms of privacy rather than examining government action to see if it is reasonable. Under “reasonable expectations” doctrine, things that are left in plain view are always available to the government while things that are hidden—well, the Court will look to see whether keeping it private comports with “reasonable expectations.”

The majority ruling in Katz rested on physical and legal protection that Katz had given to the sound of his voice when he entered a telephone booth. Because Katz had secured the privacy of his conversation, the government wasn’t allowed to access it using a wiretap—not without a warrant. That’s the rule the Court should apply here. The government can’t use uncommon surveillance technology to access private information, including private information about things that happened “in public,” without a valid warrant.

With information technology still rapidly increasing in power, it is critically important that the Supreme Court update Fourth Amendment law while maintaining its consistency with ancient property principles. Doing so will ensure that technology doesn’t render the Fourth Amendment’s protections for our “persons, papers, houses, and effects” quaint.

You can read more, and our brief, on the Cato.org page about U.S. v. Jones.

Will GPS Tracking Render the Fourth Amendment Quaint? is a post from Cato @ Liberty - Cato Institute Blog

The Hon. Alex Kozinski gave the annual B. Kenneth Simon lecture at Cato’s Constitution Day conference on September 15, 2011. He spoke about changing cultural expectations of privacy regarding new technologies and how judicial applications of the Fourth Amendment have changed over time to reflect these expectations. Judge Kozinski is the Chief Judge on the U.S. Court of Appeals for the Ninth Circuit.

Kozinski on Privacy at Constitution Day is a post from Cato @ Liberty - Cato Institute Blog

Last week, the D.C. Circuit Court of Appeals rejected a Fourth Amendment challenge to the Transportation Security Administration’s strip-search machine policies, but it found that the TSA violated the Administrative Procedure Act in rolling them out. Too bad that the court arrived at the Fourth Amendment issues before they were ripe.

The bulk of the decision was devoted to the TSA’s law violation in creating strip-search machine policies without doing a notice-and-comment rulemaking. That’s the procedure federal agencies are required to carry out when Congress has delegated them legislative authority. Congress did delegate such authority when it told the Department of Homeland Security to develop technologies that detect nonmetallic, chemical, biological, and radiological weapons in 2004′s Intelligence Reform and Terrorism Prevention Act.

“[T]he TSA has advanced no justification for having failed to conduct a notice-and-comment rulemaking,” the court wrote, adding that it expects the agency “to act promptly on remand to cure the defect in its promulgation.”

The TSA will likely spout “constantly changing threat environment” boilerplate to try and argue that it can avoid notice and comment under the APA’s “good cause” exception. An agency can skip notice and comment “when the agency for good cause finds . . . that notice and public procedure thereon are impracticable, unnecessary, or contrary to the public interest.”

But the threat environment is not “constantly changing” at the level of abstraction relevant for the strip-search machine policy—some people are out there who might try to get dangerous articles onto planes—and these machines will be in place for decades, if not permanently, under the TSA policy. They will affect the privacy and security of billions of air passenger journeys. Even if there were need for haste in rolling out the machines, nothing makes it uniquely difficult, or anything other than appropriate, for the TSA to engage in a public process to substantiate its actions.

When the TSA does a rulemaking, it will have to lay out its strip-search machine policies and—crucially—justify them. Notice-and-comment rules are subject to court review, and reversal if they are “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” That is a rather low standard, but it’s a higher standard than the agency has ever met before—none at all.

The TSA will have to exhibit how its risk management supports the installation and use of strip-search machines. How did the TSA do its asset characterization (summarizing the things it is protecting)? What are the vulnerabilities it assessed? How did it model threats and hazards (actors or things animated to do harm)? What are the likelihoods and consequences of various attacks? Risk assessment questions like these are all essential inputs into decisions about what to prioritize and how to respond.

Congress dictated detection of various harmful agents, a form of interdiction. (The other responses to risk are acceptance, prevention, and mitigation.) Given the array of choices available to it, how did the TSA select strip-search machines?

Crucially, how well do strip-search machines reach the risks identified in their risk assessment? This is a cost-benefit question. How much do strip-search machines cost to purchase, maintain, and operate? The costs denominated in dollars include money spent on buying the machines, configuring airports, and paying TSA salaries to operate the machines and process passengers. Such costs also include opportunity costs imposed on travelers when the time they spend at airports lengthens to accommodate extended security screening and variable delays. Yet more costs are denominated in lost privacy and dignity to the traveler. These are substantial, though hard to quantify.

Security benefits are also hard to quantify, but the agency should do so if it is to justify its policies as something better than random or intuitive reaction. DHS and TSA officials endlessly talk about risk and risk management, but they cannot honestly say they are doing risk management if they are not thinking these issues all the way through. I’ve offered a methodology for valuing security benefits, and security experts (as well as students) have analyzed the costs and benefits of homeland security programs. The TSA can do it too.

Watch in the rulemaking for the TSA to obfuscate, particularly in the area of threat, using claims to secrecy. “We can’t reveal what we know,” goes the argument. “You’ll have to accept our generalizations about the threat being ‘substantial,’ ‘ever-changing,’ and ‘growing.’” It’s an appeal to authority that works with much of the American public, but it is not one to which courts—a co-equal branch of the government—should so easily succumb.

If it sees it as necessary, the TSA should publish its methodology for assessing threats, then create a secret annex to the rulemaking record for court review containing the current state of threat under that methodology, and how the threat environment at the present time compares to threat over a relevant part of the recent past. A document that contains anecdotal evidence of threat is not a threat methodology. Only a way of thinking about threat that can be (and is) methodically applied over time is a methodology.

With this information in hand, a court would not only be ready to assess the TSA’s rule under the Administrative Procedure Act’s “arbitrary and capricious” standard. It would be ready to assess the reasonableness of the TSA’s strip-search machines and procedures under the Fourth Amendment.

Without that information, the D.C. Circuit plugged the strip-search machines into the strangely incoherent “administrative search” exception to the Fourth Amendment. In two pages of analysis (out of the opinion’s seventeen), the court found that strip-search machines are administrative “because the primary goal is not to determine whether any passenger has committed a crime but rather to protect the public from a terrorist attack.”

Come again?

It seems the court could have taken judicial notice that terrorist attacks are carried out through one or more criminal behaviors. People who have weapons or other dangerous articles at airport checkpoints are subject to arrest and prosecution. Crime control and public protection are one in the same, even in counterterrorism.

The “administrative search” exception to the Fourth Amendment seems to rest on the willingness of a court to abstract away the fact that individuals are prevented from proceeding where they would go (seized) while their persons, papers, and effects are rummaged (searched) for the purpose of discovering violations of the criminal laws. Earlier in the opinion, in fact, the court mocked the idea that the TSA might not “engage in ‘law enforcement, correctional, or intelligence activity.’” It surely does. This is not “administrative.” It’s criminal law enforcement.

Perhaps with a full record—a notice-and-comment rulemaking with a docket full of information and analysis—the D.C. Circuit and other courts will have the opportunity to revisit whether the TSA’s strip-search machine policies are constitutionally reasonble, or whether they’re unexamined reaction. Last week’s “loss” on the Fourth Amendment issue sets the stage for sounder thinking on the strip-search machine policy.

All of this would be obviated, of course, if airline security were restored to private hands.

Strip-Search Machines: A Loss Seeds the Win is a post from Cato @ Liberty - Cato Institute Blog

• “PBS used to ask, ‘If not PBS, then who?’ The answer now is: HBO, Bravo, Discovery, History, History International, Science, Planet Green, Sundance, Military, C-SPAN 1/2/3 and many more.”
• “The fiscal problem that is destroying U.S. economic confidence is not the fiscal balance, however. It is the level of government expenditures relative to GDP.”
• “The Pentagon’s first cyber security strategy… builds on national hysteria about threats to cybersecurity, the latest bogeyman to justify our bloated national security state.”
• “How ‘secure’ do our homes remain if police, armed with no warrant, can pound on doors at will and, on hearing sounds indicative of things moving, forcibly enter and search for evidence of unlawful activity?”
• National debt is driving the U.S. toward a double-dip recession: 

Friday Links is a post from Cato @ Liberty - Cato Institute Blog

• “Consistent bets for higher oil prices in futures markets have not been particularly lucrative.”
• “The vast, swaying bulk of America’s military has absolutely nothing to do with effectively combating terrorism—including the large land armies that we deploy to Muslim countries in efforts to destroy and then reconstitute their states.”
• “‘Poking and prodding’ is what good government does to perfect strangers. And that’s what the Obama administration has been doing, with unusual zeal, for the past 2 1/2 years.”
• The Cato 2011 State Legislative Guide is designed to help state policymakers free their constituents from the burden of overextended government and addresses unfunded pension liabilities, ballooning Medicaid enrollment, massive budget gaps, failing education systems, and other important issues.
• The Kentucky v. King decision has delivered a blow to Fourth Amendment protections:

  Read more here.

Thursday Links is a post from Cato @ Liberty - Cato Institute Blog

Every lover of liberty and the Constitution should be offended by the moniker “Privacy Bill of Rights” appended to regulatory legislation Senators John Kerry (D-MA) and John McCain (R-AZ) introduced yesterday. As C|Net’s Declan McCullagh points out, the legislation exempts the federal government and law enforcement:

[T]he measure applies only to companies and some nonprofit groups, not to the federal, state, and local police agencies that have adopted high-tech surveillance technologies including cell phone tracking, GPS bugs, and requests to Internet companies for users’ personal information–in many cases without obtaining a search warrant from a judge.

The real “Privacy Bill of Rights” is in the Bill of Rights. It’s the Fourth Amendment.

It takes a lot of gall to put the moniker “Privacy Bill of Rights” on legislation that reduces liberty in the information economy while the Fourth Amendment remains tattered and threadbare. Nevermind “reasonable expectations”: the people’s right to be secure against unreasonable searches and seizures is worn down to the nub.

Senators Kerry and McCain should look into the privacy consequences of the Internal Revenue Code. How is privacy going to fare under Obamacare? How is the Department of Homeland Security doing with its privacy efforts? What is an “administrative search”?

McCullagh was good enough to quote yours truly on the new effort from Sens. Kerry and McCain: “If they want to lead on the privacy issue, they’ll lead by getting the federal government’s house in order.”

The ‘Privacy Bill of Rights’ Is in the Bill of Rights is a post from Cato @ Liberty - Cato Institute Blog

I’ve written before about the “Mosaic Theory” some courts have recently employed to conclude that certain forms of government surveillance may trigger Fourth Amendment protection in the aggregate, even if the surveillance can be broken down into components that don’t fall under the traditional definition of a Fourth Amendment “search.” This has been applied specifically to high-tech forms of location tracking, where several judges have concluded that a person may have a privacy interest in the totality of their public movements over a long period of time, even though observing a person at any particular public place in a specific instance is not an intrusion on privacy. I’ve explained in that previous post why I find this reasoning compelling. Legal scholar Orin Kerr, however, remains unmoved, and suggests that divergent decisions applying the Mosaic Theory to government acquisition of stored cell phone location records effectively serve as a reductio of that theory:

To my mind, this opinion reveals the absurdity of Maynard’s mosaic theory. The analysis is all “look ma, no hands.” No one knows where the line is, or even what the line is. Sure, you could just count days of surveillance: perhaps 30 days triggers a warrant but 29 days doesn’t. But there is no reason the access to records has to be continuous. The government can skip around days, or get records from a few days here and a few days there. Who can tell how much is enough? No one knows what is revealing, because what is revealing depends on what the records actually say — and no one but the phone companies know what they say. So Judge Orenstein has to wing it, announcing that “he cannot assume” that the information would be revealing because it has breaks in time. But it’s not clear to me why the break in time matters: It’s the same net amount of data collected, so I don’t know why it matters if it was collected all at once or over several discrete periods. And how much of a break matters? If 21 days is too long, is 21 days with a one-day break enough? How about a 3-day break? One week? No one knows, it seems, not even the judge himself. [....]

There are some readers who will say that the cause of justice sometimes requires hard decisions, and that if judges need to make arbitrary calls like that, then that is what we pay them to do in order to enforce the Constitution. But as I see it, the oddity of the inquiries called for by the Maynard mosaic theory shows why it is not part of the Constitution at all. In Fourth Amendment law, the lawfulness of government conduct has always been viewed discretely: Each government act is either a search or it is not a search. Under Maynard, conduct can be a non-search if viewed in isolation but a search if viewed in context — but there is no guide to tell how much context is proper. If you want to say that certain conduct is a search, then just be direct and say it’s a search. That’s fine. But a mosaic theory, in which non-searches become searches if grouped a particular way, has no proper place in Fourth Amendment law.

Orin’s point about the seeming arbitrariness of these determinations—and the difficulties it presents to police officers who need a rule to rely on—is certainly well taken. The problem is, the government is always going to have substantial control over how any particular effort at information gathering is broken into “acts” that the courts are bound to view “discretely.” If technology makes it easy to synthesize distinct pieces of information, and Fourth Amendment scrutiny is concerned exclusively with whether each particular “act” of information acquisition constitutes a search, the government ends up with substantial ability to game the system by structuring its information gathering as a series of acquisitions, each individually below the threshold.

Let’s consider a concrete case involving location monitoring. Under the Supreme Court’s ruling in United States v. Karo, technological location monitoring does count as a Fourth Amendment search requiring a warrant when it reveals information about where the tracking device is located within a private place, such as a home. On this theory, if the police want to be able to pinpoint a target’s location with sufficient precision to be able to tell when he goes from the garage on one side of the house to the bedroom at the other end, they’ll need a full blown search warrant. If they just want to know the general area the target is in—which cellular tower the phone is closest to, for instance—a subpoena or another less demanding form of court order might be sufficient.

There are, however, several methods of determining a phone’s precise location by triangulation, using data from multiple cell towers—and many cell networks use these methods to provide location services. The records from any one cell tower only yield a very general radius within which each phone registered at that tower can be presumed to be located. Combine the records from the three nearest towers, however, along with some measurements of signal strength and timing, and in an urban area where towers are relatively densely packed, you can often pinpoint the phone within a few meters.

Let’s suppose, then, that existing doctrine would require a warrant if police plan to go to the phone company and say: “We want you to triangulate the precise location of this phone for us over the past month, including at times when our suspect was at home.” What a hassle! They’ve got an out, though: They can issue separate requests for the records from each tower, then combine the data and do the triangulation themselves. As long as each request “viewed discretely” doesn’t yield enough information to pinpoint the phone within the home, there’s no search!

I don’t mean to suggest that, in practice, police are likely to use this particular method to circumvent the warrant requirement—though I wouldn’t be shocked either. But I think the example illustrates a problem with Orin’s categorical insistence on making the binary search/no-search determination only with respect to isolated “acts” of government, when the government itself controls how its monitoring is distributed across discrete acts.

Here’s another example, and one where I think there is a very real possibility that investigators are able, in practice, to game the standards governing electronic surveillance. According to the Justice Department’s U.S. Attorneys Manual, a “pen register” (which can be obtained much more easily than a search warrant) can be used to obtain general information about the domains or IP addresses a target is visiting, but not what particular pages somebody is reading. The idea is that there’s a sharp Fourth Amendment distinction between the “content” of a communication—its “meaning or purport”—and the non-content transactional information, such as the phone number or IP address, which tells you something about who is communicating, but not what is communicated. But there’s a loophole:

This policy does not apply to applications for pen register orders that would merely authorize collection of Internet Protocol (IP) addresses, even if such IP addresses can be readily translated into URLs or portions of URLs. Similarly, this policy does not apply to the collection, at a web server, of tracing information indicating the source of requests to view a particular URL using a trap and trace order.

Emphasis added. Roughly translated, this means that the government can obtain records showing that I accessed (say) the IP address of a particular political Web site, but not which specific articles I was reading. However, they may be able to separately go to that site and request the transactional logs for each article, then search through those to determine which articles were sent to me.

It seems very likely that technology will increasingly permit this kind of multi-step searching, perhaps in ways we can’t yet predict. For all that Orin is right to worry about the practical difficulty of determining how to group discrete acts of information gathering, the consequences of dogmatically insisting on evaluating each “act” in isolation seem equally absurd if it implies that the government will have the practical ability to transform a Fourth Amendment “search” into an unregulated (or much less regulated) “non-search” just by breaking it into smaller pieces.

Blurry Lines, Discrete Acts, and Government Searches is a post from Cato @ Liberty - Cato Institute Blog

Recently, I’ve been blogging over at the Washington Examiner‘s lively “Beltway Confidential” site, mostly on the subject of congressional war powers and President Obama’s Libyan adventure. Today’s post, “Obama Makes ‘Kinetic Military Action’ on the English Language” has a little fun with the administration’s wordgames and the legal rationales behind them. Other posts and a column on the subject are here, here, and here.

Today also brings a pair of columns–in the Wall Street Journal and the Washington Post, respectively–from conservative luminaries defending the notion that Obama has the constitutional power to bomb Libya without congressional authorization. Yoo, the legal architect of George W. Bush’s Terror Presidency, chides Tea Party Republicans like Jason Chaffetz of Utah and Justin Amash of Michigan for questioning Obama’s authority to launch a nondefensive war:

Their praiseworthy opposition to the growth of federal powers at home misleads them to resist Washington’s indispensable role abroad. They mistakenly read the 18th-century constitutional text through a modern lens—for example, understanding “declare war” to mean “start war.” When the Constitution was written, a declaration of war served diplomatic notice about a change in legal relations between nations. It had little to do with launching hostilities. In the century before the Constitution, for example, Great Britain fought numerous major conflicts but declared war only once beforehand.

Similarly, in the Post, David B. Rivkin, Jr., and Lee A. Casey write:

As commander in chief, the president has the authority to determine when and how U.S. forces are used…. When the Constitution was adopted, the power to “declare war” was not equivalent to permitting the use of military force.

The president certainly can’t derive the authority to bomb Libya from the commander-in-chief clause. As Hamilton explained in Federalist 69, that provision merely indicates that the president is the “first General and admiral” of US military forces. Important as they are, generals and admirals don’t get to decide whether and with whom we go to war.

It’s more common for presidentialists to combine a broad reading of Article II, sec. 1′s “executive Power” with an exceptionally narrow interpretation of Article I, sec. 8′s congressional power “to declare War,” to conclude that the president can start wars, leaving it up to Congress to make it official if they so choose.

One problem with that view is that virtually no one from the Founding Generation seems to have understood the clause in that way. For example, James Wilson told the Pennsylvania ratifying convention that ‘‘this system will not hurry us into war; it is calculated to guard against it. It will not be in the power of a single man, or a single body of men, to involve us in such distress; for the important power in declaring war is vested in the legislature at large.’’ Pierce Butler, like Wilson, had been a delegate to the Philadelphia Convention, and–to the dismay of some delegates–had actually argued for vesting the power to go to war in the president. Yet during the ratification debates, Butler assured the South Carolina legislature that the proposed constitution prevented the president from starting wars: ‘‘Some gentlemen [i.e., Butler himself] were inclined to give this power to the President; but it was objected to, as throwing into his hands the influence of a monarch, having an opportunity of involving his country in a war whenever he wished to promote her destruction.’’

As Professor Michael Ramsey puts it:

Every major figure from the founding era who commented on the matter said that the Constitution gave Congress the exclusive power to commit the nation to hostilities. Notably, this included not only people with reservations about presidential power, such as James Madison and Thomas Jefferson, but also strong advocates of the President’s prerogatives, such as George Washington and Alexander Hamilton.

“How could this be, though,” Ramsey asks, “if Congress has only the power to ‘declare War’, which we may think refers to making a (now-outmoded) formal announcement? Why can’t the President begin a war informally, merely by ordering an attack, without a declaration?” The answer:

…is that in founding-era terminology war could be “declared” either by formal announcement or by military action initiating hostilities. John Locke’s classic Two Treatises of Government from the late 17th century referred to “declar[ing] by word or action.” Blackstone and Vattel, two of the 18th century legal writers most influential in America, also used “declare” in this way…. Johnson’s dictionary gave as one definition of “declare” to “shew in open view” – which, applied to warfare, would obviously encompass military attacks…. Thus in 18th century terms initiating an attack was as much “to declare war” as was making a formal announcement; Congress’ Article I, Section 8 power is not narrowly about issuing formal announcements, but broadly about authorizing the sorts of actions that begin war.

Professor Ramsey lays out the argument in greater detail in his book The Constitution’s Text in Foreign Affairs, and in his (for my money) devastating 2002 rebuttal of Yoo [JSTOR] in the University of Chicago Law Review. Ramsey has further thoughts on the poverty of the argument from “past practice” here as does GMU law professor and Cato adjunct scholar Ilya Somin here.

One last point. While this doesn’t speak directly to the original meaning of the “Declare War” clause, I think it’s worth noting nonetheless:

Like Yoo, Rivkin, and Casey, I’m convinced that Obamacare’s individual mandate is unconstitutional. But consider how that view fits with their other views on federal power. They’ve argued, among other things, that the president can order up bombing raids without so much as a by-your-leave to Congress. As Yoo puts it, the president has the “right to start wars”, for good reasons, bad reasons, or no reason at all, presumably. If the president suspects you’re a terrorist, he doesn’t need a warrant to tap your phone, and, right here in America, he can send soldiers to search your house without offending the Fourth Amendment. He can (according to Yoo, at least) ignore the federal statute prohibiting torture, and he can lock you up for the duration of the war on terror (forever?) without charges.

But there is one thing that he can never, ever do: he cannot penalize you for failure to purchase health insurance. Ours is a government of limited powers, you see.

Taken all in all, doesn’t that constitutional vision strike you as… strange?

“To Declare [Kinetic Military Action]“ is a post from Cato @ Liberty - Cato Institute Blog

Senator Rand Paul is moving beyond economic issues. His critique of the Patriot Act may be found here.

Sen. Paul lauds James Otis, Jr, the most important opponent of the writs of assistance imposed by the British prior to the American Revolution.  By invoking the name of this great patriot, Sen. Paul is trying to recall for Americans the original meaning of our Revolution and Constitution. He is practicing a politics of the original public meaning of America.

An astonishing performance.

Sen. Paul and the Writs of Assistance is a post from Cato @ Liberty - Cato Institute Blog

First, the good news: Last night, civil libertarians had a rare excuse to pop champagne when an effort to fast-track a one-year reauthorization of three controversial Patriot Act provisions–set to expire at the end of the month–failed in the House of Representatives. As Slate‘s Dave Weigel notes, the vote had been seen as such a sure thing that Politico headlined its story on the pending vote “Congress set to pass Patriot Act extension.” Around this time last year, a similar extension won House approval by a lopsided 315-97 vote.

Now the reality check: The large majority of representatives also voted for reauthorization last night: 277 for, 148 against. The vote failed only because GOP leadership had sought to ram the bill through under a “suspension of the rules”–a streamlined process generally used for the most uncontroversial bills, limiting debate and barring the introduction of amendments–which required a two-thirds majority for passage. Given last week’s developments in the Senate, it’s still a near certainty that the expiring provisions will be extended again before the end of the month. In fact, there’s a Rules Committee meeting today to get the bill back on the House floor. Also, while the defection of 26 Republicans who voted against reauthorization is the first real pushback against leadership we’ve seen since the GOP took the House, some of the talk that’s circulated about a Tea Party backlash against the surveillance state seems premature. As Weigel notes, just eight of the 26 Republican “no” votes were incoming freshmen, and many representatives prominently associated with the Tea Party were on the other side. Some of the resistance seems to have been generated by the fast-track approach, as there haven’t been any hearings or mark-ups on Patriot legislation.

That said, the tide does seem to be shifting somewhat. The failure of the fast-track vote means that we may see the reauthorization introduced under rules that would allow amendments aimed at remedying the civil liberties problems with the three expiring provisions, or with the still more controversial Patriot expansion of National Security Letter authority, which under current law does not expire. For those just tuning in, the sunsetting Patriot provisions are:

Lone Wolf

So-called “lone wolf” authority allows non-citizens in the U.S. who are suspected of involvement in terrorist activities to be monitored under the broad powers afforded by the Foreign Intelligence Surveillance Act (FISA), even if they are not connected to any overseas terror group or other “foreign power.” It was passed after FBI claimed the absence of “lone wolf” authority stymied efforts to monitor the infamous “20th 9/11 Hijacker”–but a bipartisan Senate report found that this failure was actually the result of a series of gross errors by the FBI, not any gap in government surveillance powers. Moreover, Lone Wolf blurs the traditional–and constitutionally significant–distinction between foreign intelligence, where the executive enjoys greater latitude, and domestic national security investigations. The way the statute is written, Lone Wolf authority is only available in circumstances where investigators would already be able to obtain a criminal terrorism wiretap. Given of the sweeping nature of FISA surveillance, that more narrow criminal surveillance authority should be employed when the special needs imposed by the involvement of a “foreign power” are not present.

Roving Wiretaps

Roving wiretap authority allows intelligence wiretap orders to follow a target across multiple phone lines or online accounts. Similar authority has been available in criminal investigations since 1986, but Patriot’s roving wiretaps differ from the version available in criminal cases, because the target of an order may be “described” rather than identified. Courts have stressed this requirement for identification of a named target as a feature that enables criminal roving wiretaps to satisfy the “particularity” requirement of the Fourth Amendment. Patriot’s roving taps, by contrast, raise the possibility of “John Doe” warrants that name neither a person nor a specific “place” or facility–disturbingly similar to the “general warrants” the Founders were concerned to prohibit when they crafted the Fourth Amendment. Given the general breadth of FISA surveillance and the broad potential scope of online investigations, John Doe warrants would pose a high risk of “overcollecting” innocent Americans’ communications. Most civil liberties advocates would be fine with making this authority permanent if it were simply modified to match the criminal authority and foreclose the possibility of “John Doe” warrants by requiring either a named individual target or a list of specific facilities to be wiretapped.

Section 215

Section 215 expanded the authority of the FISA Court to compel the production of business records or any other “tangible thing.” While previously such orders were limited to narrow classes of businesses and records, and required a showing of “specific and articulable facts” that the records sought pertain to an agent of a foreign power, Patriot stripped away those limits. The current law requires only a showing of “reasonable grounds” to believe records are “relevant” to an investigation, not probable cause, and has no requirement that people whose information is obtained be even suspected of any connection to terrorism. And the recipients of these orders are barred from Proposals to restore some of the previous checks on this power–requiring some demonstrable connection to terroris–initially received bipartisan support last year, but were torpedoed when the Justice Department objected that this limitation would interfere with a secret “sensitive collection program.” Several senators briefed on the program have expressed concern that this sweeping collection authority was being reauthorized without adequate public understanding of its true purpose.

So those are the sunsetting provisions–though a lot of the debate last year very justifiably centered on the need to reform National Security Letters, which we know to be constitutionally defective, and which have already been subject to serious abuses. One reason reform keeps getting postponed is that Congress is busy and tends not to make time for these issues until the sunset deadlines are right around the corner–at which point a reliable band of pundits and legislators imply that absolute bedlam will ensue unless every single surveillance authority is extended–meaning reform will have to wait until later, at which point it will be an emergency all over again. Once you start looking at the numbers, though, all these Chicken Littles begin to look faintly ridiculous.

The Lone Wolf provision is such an essential intelligence tool that it has never been used. Not a single time. And again, by the terms of the statute, it only applies under circumstances where a criminal wiretap warrant would already be available if Lone Wolf authority didn’t exist. Roving authority is granted by the FISA Court an average of 22 times per year, and in many (if not most) of those cases it never actually has to be used–surveillance is limited to named facilities. To put that in context, the FISA court issued 1,320 electronic surveillance orders in 2009, and that was the first time in 5 years the number fell below 2,000. So we’re talking about maybe 1 percent of FISA surveillance, which judging by internal oversight reports, is a good deal less than the portion that ends up sitting untranslated for months anyway. Similarly, there were 21 business records orders under §215 issued in 2009–and remember, that authority doesn’t disappear if this provision sunsets, it just reverts to its narrower, pre–Patriot version, where the court needs to see actual evidence that the records have some connection to a suspected terrorist. Surveys by the Inspector General’s office found no instances in which a major case development resulted from 215 information. The idea that we’d somehow be in grave danger if these provisions lapsed for a few months just doesn’t hold up, but there’s no reason Congress can’t pass a two-month extension while they consider some of the reforms already on the table, just as they did last year.

So let’s stop living in a state of perpetual panic. Some of these provisions we’d be better off without. Some, like roving wiretaps, just need minor tweaks to close loopholes for misuse. Some–I’m looking at you, National Security Letters–require substantial reform. Many of these changes ought to be common sense, and have attracted bipartisan support in the past. But let’s stop kicking the can down the road and saying we’ll debate the proper limits on the surveillance state when there’s time. It’s important enough that Congress can make time.

Patriot Reauthorization Vote Fails… Now What? is a post from Cato @ Liberty - Cato Institute Blog

This afternoon I briefly attended a meeting of the Washington Metropolitan Area Transit Authority board to comment on the question whether there should be random bag searches in the D.C. area’s subway system. A variety of other liberty loving D.C.-area residents spoke up against bag searches, noting the weakness of the practice in terms of security, the privacy consequences, and the insult to Metro riders in treating all as suspects. The chairman of the Riders Advisory Council asked that the program be suspended.

Along with restating the security weakness of random bag searches—it simply transfers risk from one station to another, from the subway to busses, or from the Metro system to other infrastructure—I emphasized the strategic consequences of the policy:

Terrorists try to instill fear and drive victim states to over-reaction. They try to knock us off our game. The appropriate response is not to give in to fear-based impulses. Obviously, we can and do secure what can cost-effectively be secured. And where infrastructure can’t be secured specifically, many other layers of security are protecting the society as a whole—aware people, ordinary law enforcement, targeted lawful investigation of terror suspects, and international intelligence and diplomatic efforts.

WMATA can play a part in our security, but in a very different way than by making a great show of desperately searching passengers. Refusing the bag search policy can signal to D.C. area residents and the nation that we are relatively secure, because we are. Al Qaeda is on the run, and the franchises it inspired are generally incompetent.

When America’s capital city abandons bag searching, it will be a small but important signal that terrorism doesn’t knock us off our game. Consistency in this message over time will weaken terrorism and ultimately reduce terror attacks from their already low numbers.

There will never be perfect security, but security measures that cost more than they benefit our security make us worse off, not better off. They make us victims of terrorism’s strategic logic.

Fairfax County Supervisor Jeff McKay disagrees. An alternate member of the WMATA board, he is the picture of the politician  in thrall to terrorism. During the discussion of the Riders Advisory Council report, he stated—as a moral obligation, no less—that he should assume the existence of substantial threats to the Metro system because some authorities claim secret knowledge to that effect.

Whether there are threats or not, this does not respond at all to the point that random bag searches would not address them. Again, they transfer risk from one Metro station to another, from Metro stations to Metro busses, or from the Metro system to other infrastructure in the D.C. area.

We often joke about politicians who say “something must be done; this is something; this must be done,” but when you see it live and in person, it’s really stupid.

McKay seemed to take righteous pride in abdicating his responsibility to understand basic security principles as they pertain to the Metro system. He did note the bind that the board is in. They’re damned if they do bag searches because of the complaints from the community, and they’re damned if they don’t because something bad might happen.

McKay’s choice is to spend the money of District-area governments and undercut the civil liberties of Metro riders so that, in the unlikely event a terror attack occurs, his political career is protected. He can say “I tried to stop it with bag searches.” Never mind that it was an ineffective measure.

McKay thinks he’s doing the right thing, but that doesn’t excuse his being a patsy to the terrorism strategy. He’s a limp rag, abdicating his security responsibility while pretending that he fights terrorism.

Jeff McKay: A Limp Rag Masquerading as a Terror Warrior is a post from Cato @ Liberty - Cato Institute Blog

This weekend, we learned that the U.S. government last month demanded records associated with the Twitter accounts of several supporters of WikiLeaks—including American citizens and an elected member of Iceland’s parliament. As the New York Times observes, the only remarkable thing about the government’s request is that we’re learning about it, thanks to efforts by Twitter’s legal team to have the order unsealed. It seems a virtual certainty that companies like Facebook and Google have received similar demands.

Most news reports are misleadingly describing the order [PDF] as a “subpoena” when in actuality it’s a judicially-authorized order under 18 U.S.C §2703(d), colloquially known (to electronic surveillance geeks) as a “D-order.” Computer security researcher Chris Soghoian has a helpful rundown on the section and what it’s invocation entails, while those who really want to explore the legal labyrinth that is the Stored Communications Act should consult legal scholar Orin Kerr’s excellent 2004 paper on the topic.

As the Times argues in a news analysis today, this is one more reminder that our federal electronic surveillance laws, which date from 1986, are in dire need of an update. Most people assume their online communications enjoy the same Fourth Amendment protection as traditional dead-tree-based correspondence, but the statutory language allows the contents of “electronic communications” to be obtained using those D-orders if they’re older than 180 days or have already been “opened” by the recipient. Unlike traditional search warrants, which require investigators to establish “probable cause,” D-orders are issued on the mere basis of “specific facts” demonstrating that the information sought is “relevant” to a legitimate investigation. Fortunately, an appellate court has recently ruled that part of the law unconstitutional—making it clear that the Fourth Amendment does indeed apply to email… a mere 24 years after the original passage of the law.

The D-order disclosed this weekend does not appear to seek communications content—though some thorny questions might well arise if it had. (Do messages posted to a private or closed Twitter account get the same protection as e-mail?) But the various records and communications “metadata” demanded here can still be incredibly revealing. Unless the user is employing anonymizing technology—which, as Soghoian notes, is fairly likely when we’re talking about such tech-savvy targets—logs of IP addresses used to access a service like Twitter may help reveal the identity of the person posting to an anonymous account, as well as an approximate physical location. The government may also wish to analyze targets’ communication patterns in order to build a “social graph” of WikiLeaks supporters and identify new targets for investigation. (The use of a D-order, as opposed to even less restrictive mechanisms that can be used to obtain basic records, suggests they’re interested in who is talking to whom on the targeted services.) Given the degree of harassment to which known WikiLeaks supporters have been subject, easy access to such records also threatens to chill what the courts have called “expressive association.” But unlike traditional wiretaps, D-order requests for data aren’t even subject to mandatory reporting requirements—which means surveillance geeks may be confident this sort of thing is fairly routine, but the general public lacks any real sense of just how pervasive it is. Whatever your take on WikiLeaks, then, this rare peek behind the curtain is one more reminder that our digital privacy laws are long overdue for an upgrade.

Wikileaks, Twitter, and Our Outdated Electronic Surveillance Laws is a post from Cato @ Liberty - Cato Institute Blog

Writing in the Washington Post, George Washington University law professor Jeffrey Rosen carefully concludes, “there’s a strong argument that the TSA’s measures violate the Fourth Amendment, which prohibits unreasonable searches and seizures.” The strip/grope policy doesn’t carefully escalate through levels of intrusion the way a better designed program using more privacy protective technology could.

It’s a good constutional technician’s analysis. But Professor Rosen doesn’t broach one of the most important likely determinants of Fourth Amendment reasonableness: the risk to air travel these searches are meant to reduce.

Writing in Politico last week, I pointed out that there have been 99 million domestic flights in the last decade, transporting seven billion passengers. Not one of these passengers snuck a bomb onto a plane and detonated it. Given that this period coincides with the zenith of Al Qaeda terrorism, this suggests a very low risk.

Proponents of the TSA’s regime point out that threats are very high, according to information they have. But that trump card—secret threat information—is beginning to fail with the public. It would take longer, but would eventually fail with courts, too.

But rather than relying on courts to untie these knots, Congress should subject TSA and the Department of Homeland Security to measures that will ultimately answer the open risk questions: Require any lasting security measures to be justified on the public record with documented risk management and cost-benefit analysis. Subject such analyses to a standard of review such as the Adminstrative Procedure Act’s “arbitrary and capricious” standard. Indeed, Congress might make TSA security measures APA notice-and-comment rules, with appropriate accomodation for (truly) temporary measures required by security exigency.

Claims to secrecy are claims to power. Congress should withdraw the power of secrecy from the TSA and DHS, subjecting these agencies to the rule of law.

TSA’s Strip/Grope: Unconstitutional? is a post from Cato @ Liberty - Cato Institute Blog

The law normally advances by small and cautious steps—by the gradual extension of established precedents and rules to novel problems and fact patterns. Little wonder, then, that tricky questions of law often amount to conflicts between competing metaphors. Is a hard drive like a closed briefcase whose contents are all fair game for police once the “container” is legitimately opened? Or is it more like a warehouse containing hundreds or thousands of individual closed containers? If the latter, what are the “containers”? Directories? Individual files?

A similar metaphor war figures in the FBI’s effort to expand its authority to acquire information from Internet Service Providers using National Security Letters, which are issued by agents without judicial oversight, and typically forbid providers from disclosing anything about the demand for records. The Bureau had long assumed that the NSL statutes gave them broad authority to get “electronic communications transaction records”—information about your online communications, though not the contents of the communications themselves—as long as they certified that those records would be “relevant” to a national security investigation, a far lower standard than the Fourth Amendment’s “probable cause.” But in a 2008 opinion, the Bush administration’s Office of Legal Counsel rejected this interpretation, finding that NSLs could only be used to obtain the particular types of records specified in the statute, including “toll billing records.” For Internet accounts, this meant the FBI could only get “information parallel to… toll billing records for ordinary telephone service.”

The obvious question is what, exactly, constitutes information “parallel to” a toll billing record in the online context. The FBI would prefer to resolve the ambiguity by simply amending the law to give them blanket authority to acquire transaction records. In particular, according to The Washington Post, government lawyers think they can obtain “the addresses to which an Internet user sends e-mail; the times and dates e-mail was sent and received; and possibly a user’s browser history.” On its face, this sounds like a reasonable reading. An important 1979 Supreme Court case, Smith v. Maryland, held that the information contained in telephone “toll billing records”—the itemized list of calls placed and received you’d find on a standard phone bill—didn’t enjoy Fourth Amendment protection, and so unlike the contents of phone conversations themselves, could be obtained by the government without a full probable cause warrant. Surely the obvious equivalent in the online context is the list of e-mail addresses in an Internet user’s inbox and outbox? At a second glance, though, there are some problems with that metaphor, of two central kinds.

First, there’s a problem with the formal analogy. The Court in Smith supported their finding of a diminished privacy interest in toll billing records on numerous grounds.  For one, the Court noted that because one’s itemized phone bill did contain these numbers, no reasonable person could be unaware that this information was “exposed” to employees of the phone company and retained as a matter of course among the company’s business records. Of course, it’s now increasingly common for phone companies to charge a flat rate rather than billing by individual calls, and so the legislative history of the NSL statutes makes clear that by “toll billing records” they mean information that could be used to assess a charge, even if a company happened not to charge that way.

The analogy gets pretty strained when we come to Internet services, though. At the time the laws in question here were written, ISPs almost universally charged people for the amount of time they were connected, not by the number of individual e-mails sent. Now it’s much more common to simply play a flat monthly fee for broadband connection, though you also sometimes see plans where there’s a charge by the megabyte above a certain threshold of bandwidth usage. Your ISP, of course has technical access to the list of e-mail addresses you’ve communicated with—just as they have the ability to access the e-mails themselves—but no major service, as far as I know, has ever actually kept this list as a separate billing record.

But maybe that’s not the right way to apply the metaphor. Maybe what’s important is whether those to/from e-mail records are substantively “parallel to” the kind of information you’d traditionally find in telephone toll billing records. As the Smith Court observed, a list of phone numbers was far less revealing and sensitive than the actual conversation—it revealed nothing of the “purport” of the communication itself, or even who was on the call. But as soon as we start to think more carefully about how we actually use e-mail in the real world, it becomes clear that the analogy is far from perfect.

One thing lots of people do with e-mail, after all, is participate in mailing lists and discussion groups.  Records of this sort, then, are likely to reveal the membership in potentially controversial social, political, or religious groups—and the Supreme Court has also found that such membership lists enjoy First Amendment protection as a component of freedom of association. But they’d also reveal much more than that. The closest telephone analogue to a mailing list discussion is probable a conference call.  An investigator who obtained toll billing records for such a call would, at most, have learned that a certain number of people called in for a certain amount of time; they’d learn nothing about who spoke in response to whom, or how much, and who remained silent.  Someone getting  e-mail transaction records would have a much more detailed picture of who was vocal and who was silent, the order and frequency with which participants spoke, and so on. And more generally, people in practice do not use e-mail like traditional letters: They tend to have exchanges in which each individual e-mail is more like a piece of the longer conversation.

There are also many common uses of e-mail that don’t really have close analogies in the telephonic context.  If I make a purchase from Amazon, win an Ebay auction,  make an OpenTable restaurant reservation, register for a conference at a local think tank, or place a Craigslist ad, that will typically generate an automatic confirmation e-mail from the site, and the e-mail address from which the site comes will often reveal something about the nature of the transaction. (My inbox has messages from auto-confirm, order-update, ship-confirm, and  store-news @amazon.com—inherently more revealing than the mere fact that I called some mail-order vendor.) It’s not a particularly big deal in those cases, but such e-mails could also reveal that I had opened or closed or modified an account at a particular politically, sexually, or religiously oriented Web site, or subscribed to a specific publication.

For an example of just how sensitive and revealing such task-specific e-mail addresses can be, consider Craigslist in particular. The site—which for those who haven’t used it is the vast online equivalent of the newspaper’s classified section—generates an individual anonymized e-mail addresses for each ad placed, so that users don’t have to expose their own contact information to the world. Yet while this provides anonymity against the general public, it also makes those mere e-mail addresses much more revealing to the government agent who obtains transaction records. That’s because each ad can be linked to a particular e-mail address, so if you’ve sent a message to pers-1234567-ABCD@craigslist.com, the government may not know exactly who you’ve written, but they can determine why you’re writing: To respond to an ad offering a handgun for sale, say, or one soliciting a foot fetishist for a “casual encounter.”

The point is not just that investigators shouldn’t be able to get e-mail transaction records without a probable cause warrant—though I happen to think that would be a reasonable standard. It’s that metaphors can mislead us: We need to look past the easy equivalencies between new technologies and more traditional forms of communication, and drill down to see the full range of privacy interests implicated given the real-world practices of ordinary people who use those technologies.

Phone Numbers, E-Mail Addresses, and Metaphor Wars is a post from Cato @ Liberty - Cato Institute Blog

The Electronic Frontier Foundation trumpets a surprising privacy win last week in the U.S. Court of Appeals for the D.C. Circuit. In U.S. v. Maynard (PDF), the court held that the use of a GPS tracking device to monitor the public movements of a vehicle—something the Supreme Court had held not to constitute a Fourth Amendment search in U.S. v Knotts—could nevertheless become a search when conducted over an extended period.  The Court in Knotts had considered only tracking that encompassed a single journey on a particular day, reasoning that the target of surveillance could have no “reasonable expectation of privacy” in the fact of a trip that any member of the public might easily observe. But the Knotts Court explicitly reserved judgment on potential uses of the technology with broader scope, recognizing that “dragnet” tracking that subjected large numbers of people to “continuous 24-hour surveillance.” Here, the DC court determined that continuous tracking for a period of over a month did violate a reasonable expectation of privacy—and therefore constituted a Fourth Amendment search requiring a judicial warrant—because such intensive secretive tracking by means of public observation is so costly and risky that no  reasonable person expects to be subject to such comprehensive surveillance.

Perhaps ironically, the court’s logic here rests on the so-called “mosaic theory” of privacy, which the government has relied on when resisting Freedom of Information Act requests.  The theory holds that pieces of information that are not in themselves sensitive or potentially injurious to national security can nevertheless be withheld, because in combination (with each other or with other public facts) permit the inference of facts that are sensitive or secret.  The “mosaic,” in other words, may be far more than the sum of the individual tiles that constitute it. Leaving aside for the moment the validity of the government’s invocation of this idea in FOIA cases, there’s an obvious intuitive appeal to the idea, and indeed, we see that it fits our real world expectations about privacy much better than the cruder theory that assumes the sum of “public” facts must always be itself a public fact.

Consider an illustrative hypothetical.  Alice and Bob are having a romantic affair that, for whatever reason, they prefer to keep secret. One evening before a planned date, Bob stops by the corner pharmacy and—in full view of a shop full of strangers—buys some condoms.  He then drives to a restaurant where, again in full view of the other patrons, they have dinner together.  They later drive in separate cars back to Alice’s house, where the neighbors (if they care to take note) can observe from the presence of the car in the driveway that Alice has an evening guest for several hours. It being a weeknight, Bob then returns home, again by public roads. Now, the point of this little story is not, of course, that a judicial warrant should be required before an investigator can physically trail Bob or Alice for an evening.  It’s simply that in ordinary life, we often reasonably suppose the privacy or secrecy of certain facts—that Bob and Alice are having an affair—that could in principle be inferred from the combination of other facts that are (severally) clearly public, because it would be highly unusual for all of them to be observed by the same public.   Even more so when, as in Maynard, we’re talking not about the “public” events of a single evening, but comprehensive observation over a period of weeks or months.  One must reasonably expect that “anyone” might witness any of such a series of events; it does not follow that one cannot reasonably expect that no particular person or group would be privy to all of them. Sometimes, of course, even our reasonable expectations are frustrated without anyone’s rights being violated: A neighbor of Alice’s might by chance have been at the pharmacy and then at the restaurant. But as the Supreme Court held in Kyllo v US, even when some information might in principle be possible to obtain public observation, the use of technological means not in general public use to learn the same facts may nevertheless qualify as a Fourth Amendment search, especially when the effect of technology is to render easy a degree of monitoring that would otherwise be so laborious and costly as to normally be infeasible.

Now, as Orin Kerr argues at the Volokh Conspiracy, significant as the particular result in this case might be, it’s the approach to Fourth Amendment privacy embedded here that’s the really big story. Orin, however, thinks it a hopelessly misguided one—and the objections he offers are all quite forceful.  Still, I think on net—especially as technology makes such aggregative monitoring more of a live concern—some kind of shift to a “mosaic” view of privacy is going to be necessary to preserve the practical guarantees of the Fourth Amendment, just as in the 20th century a shift from a wholly property-centric to a more expectations-based theory was needed to prevent remote sensing technologies from gutting its protections. But let’s look more closely at Orin’s objections.

First, there’s the question of novelty. Under the mosaic theory, he writes:

[W]hether government conduct is a search is measured not by whether a particular individual act is a search, but rather whether an entire course of conduct, viewed collectively, amounts to a search. That is, individual acts that on their own are not searches, when committed in some particular combinations, become searches. Thus in Maynard, the court does not look at individual recordings of data from the GPS device and ask whether they are searches. Instead, the court looks at the entirety of surveillance over a one-month period and views it as one single “thing.” Off the top of my head, I don’t think I have ever seen that approach adopted in any Fourth Amendment case.

I can’t think of one that explicitly adopts that argument.  But consider again the Kyllo case mentioned above.  Without a warrant, police used thermal imaging technology to detect the presence of marijuana-growing lamps within a private home from a vantage point on a public street. In a majority opinion penned by Justice Scalia, the court balked at this: The scan violated the sanctity and privacy of the home, though it involved no physical intrusion, by revealing the kind of information that might trigger Fourth Amendment scrutiny. But stop and think for a moment about how thermal imaging technology works, and try to pinpoint where exactly the Fourth Amendment “search” occurs.  The thermal radiation emanating from the home was, well… emanating from the home, and passing through or being absorbed by various nearby people and objects. It beggars belief to think that picking up the radiation could in itself be a search—you can’t help but do that!

When the radiation is actually measured, then? More promising, but then any use of an infrared thermometer within the vicinity of a home might seem to qualify, whether or not the purpose of the user was to gather information about the home, and indeed, whether or not the thermometer was precise enough to reveal any useful information about internal temperature variations within the home.  The real privacy violation here—the disclosure of private facts about the interior of the home—occurs only when a series of very many precise measurements of emitted radiation are processed into a thermographic image.  To be sure, it is counterintuitive to describe this as a “course of conduct” because the aggregation and analysis are done quite quickly within the processor of the thermal camera, which makes it natural to describe the search as a single act: Creating a thermal image.  But if we zoom in, we find that what the Court deemed an unconstitutional invasion of privacy was ultimately the upshot of a series of “public” facts about ambient radiation levels, combined and analyzed in a particular way.  The thermal image is, in a rather literal sense, a mosaic.

The same could be said about long-distance  spy microphones: Vibrating air is public; conversations are private. Or again, consider location tracking, which is unambiguously a “search” when it extends to private places: It might be that what is directly measured is only the “public” fact about the strength of a particular radio signal at a set of receiver sites; the “private” facts about location could be described as a mere inference, based on triangulation analysis (say), from the observable public facts.

There’s also a scope problem. When, precisely, do individual instances of permissible monitoring become a search requiring judicial approval? That’s certainly a thorny question, but it arises as urgently in the other type of hypothetical case alluded to in Knotts, involving “dragnet” surveillance of large numbers of individuals over time. Here, too, there’s an obvious component of duration: Nobody imagines that taking a single photograph revealing the public locations of perhaps hundreds of people at a given instant constitutes a Fourth Amendment search. And just as there’s no precise number of grains of sand that constitutes a “heap,” there’s no obvious way to say exactly what number of people, observed for how long, are required to distinguish individualized tracking from “dragnet” surveillance.  But if we anchor ourselves in the practical concerns motivating the adoption of the Fourth Amendment, it seems clear enough that an interpretation that detected no constitutional problem with continuous monitoring of every public movement of every citizen would mock its purpose. If we accept that much, a line has to be drawn somewhere. As I recall, come to think of it, Orin has himself proposed a procedural dichotomy between electronic searches that are “person-focused” and those that are “data-focused.”  This approach has much to recommend it, but is likely to present very similar boundary-drawing problems.

Orin also suggests that the court improperly relies upon a “probabilistic” model of the Fourth Amendment here (looking to what expectations about monitoring are empirically reasonable) whereas the Court has traditionally relied on a “private facts” model to deal with cases involving new technologies (looking to which types of information it is reasonable to consider private by their nature). Without recapitulating the very insightful paper linked above, the boundaries between models in Orin’s highly useful schema do not strike me as quite so bright. The ruling in Kyllo, after all, turned in part on the fact that infrared imaging devices are not in “general public use,” suggesting that the identification of “private facts” itself has an empirical and probabilistic component.  The analyses aren’t really separate. What’s crucial to bear in mind is that there are always multiple layers of facts involved with even a relatively simple search: Facts about the strength of a particular radio signal, facts about a location in a public or private place at a particular instant, facts about Alice and Bob’s affair. In cases involving new technologies, the problem—though seldom stated explicitly—is often precisely which domain of facts to treat as the “target” of the search. The point of the expectations analysis in Maynard is precisely to establish that there is a domain of facts about macro-level behavioral patterns distinct from the unambiguously public facts about specific public movements at particular times, and that we have different attitudes about these domains.

Sorting all this out going forward is likely to be every bit as big a headache as Orin suggests. But if the Fourth Amendment has a point—if it enjoins us to preserve a particular balance between state power and individual autonomy—then as technology changes, its rules of application may need to get more complicated to track that purpose, as they did when the Court ruled that an admirably simple property rule was no longer an adequate criterion for identifying a “search.”  Otherwise we make Fourth Amendment law into a cargo cult, a set of rituals whose elegance of form is cold consolation for their abandonment of function.

GPS Tracking and a ‘Mosaic Theory’ of Government Searches is a post from Cato @ Liberty - Cato Institute Blog

Fourth Amendment:

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

Supreme Court (Katz v. U.S.):

“[S]earches conducted outside the judicial process, without prior approval by judge or magistrate, are per se unreasonable under the Fourth Amendment—subject only to a few specifically established and well delineated exceptions.”

Washington Post:

“The Obama administration is seeking to make it easier for the FBI to compel companies to turn over records of an individual’s Internet activity without a court order if agents deem the information relevant to a terrorism or intelligence investigation.”

Compare and Contrast is a post from Cato @ Liberty - Cato Institute Blog