Such information can be extracted directly from a phone. But doing so legally requires a judge to issue a warrant. And for this, law enforcement officials must show they have probable cause to believe such a search is justified. This requirement can deter frivolous searches—but it can also be evaded with relative ease. In particular, privacy activists warn that law enforcement agencies can sidestep the need for a warrant by obtaining much of the same information from private companies. “A little-known treasure trove of information about Americans is held by data brokers, who sell their digital dossiers about people to whoever will pay their fee,” explains Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory. “Law enforcement agencies have used data brokers to do an end run around the Fourth Amendment’s warrant requirement. They just buy the information they’d otherwise need a warrant to get.”

They can also access these data by presenting a tech company with a subpoena, which is easier to obtain than a warrant because it only requires “reasonable suspicion” of the need for a search, Greer explains, not the higher bar of probable cause. “We also have seen law enforcement in the past issue [subpoenas for] incredibly broad requests,” Greer says. “For example, requesting that a search engine hand over the IP addresses of everyone who has searched for a specific term or requesting that a cell phone company hand over what’s considered ‘geofence data,’ [which reveal] all of the cell phones that were in a certain area at a certain time.”