Just how much privacy do we have when traveling with our cellphones? According to a dramatic Supreme Court ruling this morning, the third-party doctrine of Smith and Miller do not apply to location data, which is collected without much thought or active consent. A 5-4 decision in Carpenter v US ruled that the nature of locator data puts privacy more at risk, requiring a warrant based on probable cause — and overturned a conviction that resulted in a 100-year sentence:

In a 5-4 decision, the U.S. Supreme Court gave a victory to privacy advocates Friday, ruling that police generally must have permission from a judge before they can get cell phone records to plot the movements of individual customers.

The decision requires police departments nationwide to get a search warrant in order to obtain telephone company data to track where a user has been. The technique is widespread, given that 95 percent of Americans own a cell phone. …

The Supreme Court’s ruling came in a case brought by a Michigan man, Timothy Carpenter, who was convicted of robbing a string of Radio Shack and T-Mobile stores after FBI agents used three months of cell phone records to show that he was near each store at the time of the crimes. He argued that because the FBI did not get a search warrant, that evidence, along with his conviction, should be thrown out.

Carpenter lost in the lower courts, which ruled that no search warrant was needed because phone customers have no expectation that their records will be private. Those decisions relied on a Supreme Court case from 38 years ago. It said phone customers don’t expect that the numbers they dial will remain private, because the phone company uses that information for billing.

But Carpenter’s lawyers argued that the reasoning of that case, issued when telephones were hard-wired into the wall and didn’t move, should not apply in the digital age, when customers expect their calling patterns to remain private. Getting cell phone tower location data, they said, allows the police to discover far more than which numbers were dialed.

That argument didn’t quite carry the day, perhaps in part because of earlier rulings on what’s known as “pen-register data.” Law enforcement (and intelligence agencies) now routinely get access to “calling patterns” without specific warrants based on probable cause, as that data (arguably) doesn’t implicate privacy to the same extent. To use the usual analogy, it’s akin to looking at the outside of an envelope without opening it to read the letter inside.

In the case of locator data, however, the court ruled that such intrusions implicate the reasonable expectation of privacy of movement. That kind of data requires probable cause to access if not given freely by the principal, even if it is being collected by a third party:

(c) Tracking a person’s past movements through CSLI partakes of many of the qualities of GPS monitoring considered in Jones—it is detailed, encyclopedic, and effortlessly compiled. At the same time, however, the fact that the individual continuously reveals his location to his wireless carrier implicates the third-party principle of Smith and Miller. Given the unique nature of cell-site records, this Court declines to extend Smith and Miller to cover them. Pp. 10–18.

(1) A majority of the Court has already recognized that individuals have a reasonable expectation of privacy in the whole of their physical movements. Allowing government access to cell-site records—which “hold for many Americans the ‘privacies of life,’ ” Riley v. California, 573 U. S. ___, ___—contravenes that expectation. In fact, historical cell-site records present even greater privacy concerns than the GPS monitoring considered in Jones: They give the Government near perfect surveillance and allow it to travel back in time to retrace a person’s whereabouts, subject only to the five-year retention policies of most wireless carriers. The Government contends that CSLI data is less precise than GPS information, but it thought the data accurate enough here to highlight it during closing argument in Carpenter’s trial. …

The Government did not obtain a warrant supported by probable cause before acquiring Carpenter’s cell-site records. It acquired those records pursuant to a court order under the Stored Communications Act, which required the Government to show “reasonable grounds” for believing that the records were “relevant and material to an ongoing investigation.” 18 U. S. C. §2703(d). That showing falls well short of the probable cause required for a warrant. Consequently, an order issued under §2703(d) is not a permissible mechanism for accessing historical cell-site records. Not all orders compelling the production of documents will require a showing of probable cause. A warrant is required only in the rare case where the suspect has a legitimate privacy interest in records held by a third party. And even though the Government will generally need a warrant to access CSLI, case-specific exceptions—e.g., exigent circumstances—may support a warrantless search. Pp. 18–22.

That’s a pretty compelling argument, although as you’ll shortly see, there are compelling arguments against it too. Few things are more private and more prized in American life as freedom of movement. Police can surveil suspects in real time without recourse to a warrant, but they have to do so personally and without tracking devices. Only when they have a warrant can they attach GPS devices and other kinds of tracking, and applying that consideration to historical tracking data seems to make sense.

However, it doesn’t make sense as a 4th Amendment issue to the court’s other conservatives. Interestingly, Chief Justice John Roberts joined the liberal wing of the court to reach this controlling opinion. Anthony Kennedy joined the other conservatives in opposition, arguing that the court has unmoored the 4th Amendment from its ties to property rights. Kennedy also argues that Congress has already addressed this issue satisfactorily with the Smith and Miller precedents in mind:

The Government acquired the records through an investigative process enacted by Congress. Upon approval by a neutral magistrate, and based on the Government’s duty to show reasonable necessity, it authorizes the disclosure of records and information that are under the control and ownership of the cell phone service provider, not its customer. Petitioner acknowledges that the Government may obtain a wide variety of business records using compulsory process, and he does not ask the Court to revisit its precedents. Yet he argues that, under those same precedents, the Government searched his records when it used court-approved compulsory process to obtain the cell-site information at issue here.

Cell-site records, however, are no different from the many other kinds of business records the Government has a lawful right to obtain by compulsory process. Customers like petitioner do not own, possess, control, or use the records, and for that reason have no reasonable expectation that they cannot be disclosed pursuant to lawful compulsory process.

The Court today disagrees. It holds for the first time that by using compulsory process to obtain records of a business entity, the Government has not just engaged in an impermissible action, but has conducted a search of the business’s customer. The Court further concludes that the search in this case was unreasonable and the Government needed to get a warrant to obtain more than six days of cell-site records.

In concluding that the Government engaged in a search, the Court unhinges Fourth Amendment doctrine from the property-based concepts that have long grounded the analytic framework that pertains in these cases. In doing so it draws an unprincipled and unworkable line between cell-site records on the one hand and financial and telephonic records on the other. According to today’s majority opinion, the Government can acquire a record of every credit card purchase and phone call a person makes over months or years without upsetting a legitimate expectation of privacy. But, in the Court’s view, the Government crosses a constitutional line when it obtains a court’s approval to issue a subpoena for more than six days of cell-site records in order to determine whether a person was within several hundred city blocks of a crime scene. That distinction is illogical and will frustrate principled application of the Fourth Amendment in many routine yet vital law enforcement operations. …

This case should be resolved by interpreting accepted property principles as the baseline for reasonable expectations of privacy.

Clarence Thomas agrees, noting that the property in question belonged in the first instance to the carrier, not the defendant:

This case should not turn on “whether” a search occurred. Ante, at 1. It should turn, instead, on whose property was searched. The Fourth Amendment guarantees individuals the right to be secure from unreasonable searches of “their persons, houses, papers, and effects.” (Emphasis added.) In other words, “each person has the right to be secure against unreasonable searches . . . in his own person, house, papers, and effects.” Minnesota v. Carter, 525 U. S. 83, 92 (1998) (Scalia, J., concurring). By obtaining the cell-site records of MetroPCS and Sprint, the Government did not search Carpenter’s property. He did not create the records, he does not maintain them, he cannot control them, and he cannot destroy them. Neither the terms of his contracts nor any provision of law makes the records his. The records belong to MetroPCS and Sprint.

The Court concludes that, although the records are not Carpenter’s, the Government must get a warrant because Carpenter had a reasonable “expectation of privacy” in the location information that they reveal. Ante, at 11. I agree with JUSTICE KENNEDY, JUSTICE ALITO, JUSTICE GORSUCH, and every Court of Appeals to consider the question that this is not the best reading of our precedents.

Neil Gorsuch also wrote a dissent, but rather than rely on Smith, Miller, or Katz, Gorsuch attacks the entire line of precedent on third-party information. The newest member of the court writes a damning narrative on the decisions that led to today’s contradictory ruling:

As a result, Katz has yielded an often unpredictable— and sometimes unbelievable—jurisprudence. Smith and Miller are only two examples; there are many others. Take Florida v. Riley, 488 U. S. 445 (1989), which says that a police helicopter hovering 400 feet above a person’s property invades no reasonable expectation of privacy. Try that one out on your neighbors. Or California v. Greenwood, 486 U. S. 35 (1988), which holds that a person has no reasonable expectation of privacy in the garbage he puts out for collection. In that case, the Court said that the homeowners forfeited their privacy interests because “[i]t is common knowledge that plastic garbage bags left on or at the side of a public street are readily accessible to animals, children, scavengers, snoops, and other members of the public.” Id., at 40 (footnotes omitted). But the habits of raccoons don’t prove much about the habits of the country. I doubt, too, that most people spotting a neighbor rummaging through their garbage would think they lacked reasonable grounds to confront the rummager. Making the decision all the stranger, California state law expressly protected a homeowner’s property rights in discarded trash. Id., at 43. Yet rather than defer to that as evidence of the people’s habits and reasonable expectations of privacy, the Court substituted its own curious judgment.

Resorting to Katz in data privacy cases threatens more of the same. Just consider. The Court today says that judges should use Katz’s reasonable expectation of privacy test to decide what Fourth Amendment rights people have in cell-site location information, explaining that “no single rubric definitively resolves which expectations of privacy are entitled to protection.” Ante, at 5. But then it offers a twist. Lower courts should be sure to add two special principles to their Katz calculus: the need to avoid “arbitrary power” and the importance of “plac[ing] obstacles in the way of a too permeating police surveillance.” Ante, at 6 (internal quotation marks omitted). While surely laudable, these principles don’t offer lower courts much guidance. The Court does not tell us, for example, how far to carry either principle or how to weigh them against the legitimate needs of law enforcement. At what point does access to electronic data amount to “arbitrary” authority? When does police surveillance become “too permeating”? And what sort of “obstacles” should judges “place” in law enforcement’s path when it does? We simply do not know.

Gorsuch advises the court to dump Katz and its progeny altogether and stick to the text of the Fourth Amendment instead. In this, he echoes Kennedy and Thomas, while demanding a complete break from the past 50 years of court rulings:

There is another way. From the founding until the 1960s, the right to assert a Fourth Amendment claim didn’t depend on your ability to appeal to a judge’s personal sensibilities about the “reasonableness” of your expectations or privacy. It was tied to the law. Jardines, 569 U. S., at 11; United States v. Jones, 565 U. S. 400, 405 (2012). The Fourth Amendment protects “the right of the people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures.” True to those words and their original understanding, the traditional approach asked if a house, paper or effect was yours under law. No more was needed to trigger the Fourth Amendment. …

What does all this mean for the case before us? To start, I cannot fault the Sixth Circuit for holding that Smith and Miller extinguish any Katz-based Fourth Amendment interest in third party cell-site data. That is the plain effect of their categorical holdings. Nor can I fault the Court today for its implicit but unmistakable conclusion that the rationale of Smith and Miller is wrong; indeed, I agree with that. The Sixth Circuit was powerless to say so, but this Court can and should. At the same time, I do not agree with the Court’s decision today to keep Smith and Miller on life support and supplement them with a new and multilayered inquiry that seems to be only Katzsquared. Returning there, I worry, promises more trouble than help. Instead, I would look to a more traditional Fourth Amendment approach. Even if Katz may still supply one way to prove a Fourth Amendment interest, it has never been the only way. Neglecting more traditional approaches may mean failing to vindicate the full protections of the Fourth Amendment.

Our case offers a cautionary example. It seems to me entirely possible a person’s cell-site data could qualify as his papers or effects under existing law.

Congress could still act to make it so, although it seems doubtful that it will become a high priority for either party. Roberts insists that the ruling in Carpenter will be “narrow” and not applicable to real-time data, but is that the case? As Gorsuch notes, that’s impossible to say, given the lack of clear lines for the balancing act Carpenter will require.

It’s not too much, perhaps, for prosecutors and investigators to wait for probable cause before seeking a warrant, and data-mining does represent a privacy threat; it’s worth asking how many other cell-phone users could get caught up in investigations like this simply because of their proximity to the crimes before investigators settled fully on the right perpetrator. The issue now is that privacy considerations are attached to property that is literally owned by others, rather than the personal connection explicitly stated in the 4th Amendment. The Katz/Smith/Miller minefield doesn’t give much hope for a balanced and consistent application of that principle in the future, either.

Carpenter himself will have his case remanded back to the trial court for reconsideration. The cell-phone tower records will become inadmissible, but the testimony of his accomplices might be enough for prosecutors to win another conviction.

Addendum: Gabriel Malor’s lengthy thread sums up my conflicted thoughts on Carpenter. Click through to read the whole argument, including Gabriel’s incisive note that a cell phone is not a “magic privacy box.”

It used to be defendants could not assert privacy interest in other people's property. CJ Roberts tells us that cell tower data is different, though, because it's just so personal.

But how is cell location data more personal than bank info? credit card statements? dialing info?

— Gabriel Malor (@gabrielmalor) June 22, 2018