Geofence Warrants and the Precariousness of Private Constitutional Norm-Setting

-- By JohnClayton - 12 Mar 2021

Sometimes the Constitution is good for business. Take Google and geofence warrants. Five years ago, law enforcement agencies started asking Google to disclose location data for phones linked to specified places and times. Data on which phones passed by a bank during a robbery, for example, could help generate new leads. Geofence searches are controversial. But as a Fourth Amendment matter, it is debatable whether police even need a warrant to access geofence data. The Supreme Court has expressly reserved the question.

That hasn’t stopped Google from setting its own quasi-constitutional rules: Google refuses to respond to geofence data requests without a warrant, and initially provides only anonymized data. Since Google is the lone company to receive such requests—thanks to its extensive location tracking database—its judgment on the Fourth Amendment status of geofence searches is effectively final.

This seemingly happy example underscores the precarious state of citizen privacy when third parties are both facilitators of government surveillance and shapers of Fourth Amendment norms. To permit tech companies to set search and seizure rules, then, is to submit to world where the Fourth Amendment stands as a proxy for private business interests—upheld when useful, discarded when not.

The limits of public pressure

At first, public pressure seems a viable way to influence private Fourth Amendment norm-setting. There is business value in aligning with constitutional values. Hence why Apple fights the FBI over encryption. Or why Facebook recruits pseudo-judges to legitimize its content moderation. If Google blithely forks over geolocation data, people might stop buying Android phones. Perhaps that is enough.

We should not be fooled. Not every private data peddler is subject to social pressure. Google must answer to citizens who use its services; not so for those who traffic spying data and equipment directly to law enforcement.

At a deeper level, we must grapple with the consequences of privatizing Fourth Amendment values. The new innovators of spying are unconstrained by the constitution; they now decide when the state joins their pillage. But Google’s highest allegiance is to business goals . Geofence data is worth going to court over, until it isn’t. And when the most exigent cases arise, tech companies can just give police what they want, free from oversight.

To credit Google for its stance on geofence warrants is to praise a hollow, public relations constitutionalism. We all lose when decisions about constitutional boundaries are left to the whims of corporate actors.

Reestablishing Fourth Amendment norms via legislation

As long as a constitutional vacuum exists where third-party and state spying meet, Google and others will continue making privacy decisions formerly entrusted to courts and legislatures. The former still have a role in influencing Fourth Amendment boundaries—one district court has declared geofence warrants unconstitutional. But judges cannot squeeze a general privacy law from the constitution. Ditching the third-party doctrine doesn’t tell us what data we have a reasonable expectation of privacy over in the first place. And a coherent theory on that issue won’t address the fact that the exclusionary rule reaches only the tiniest fraction of illegal spying.

How else to fill constitutional void? Two legislative approaches are worth considering.

Criminal procedural limitations

First, lawmakers might set procedural limits on when and how law enforcement can access third-party data. New York, for example, has proposed banning police use of all data from geofence searches—warranted or otherwise. Similar bills aim to restrict drone surveillance and facial recognition.

At the federal level, Congress could replace the outdated Stored Communications Act (SCA), which regulates when and how the government may access electronic data on remote servers. Such a statute could, for example, stipulate which data law enforcement could only obtain via a warrant (geolocation data, for example), and under which circumstances such a warrant could issue. An SCA replacement should also limit alternative administrative processes—like National Security Letters—that allow federal agencies to access data outside the warrant-probable cause framework.

Restricting private spying

A more aspirational approach would be to regulate third-party data collectors through a general privacy statute. Congress or state legislatures could limit private spying by banning certain types of data trafficking (of biometric information, for example), or restricting the retention of personal information. Such an approach better targets the root of our privacy crisis. Google cannot decide whether police access our data if it doesn’t have our data to begin with.

Regulating private conduct presents more roadblocks. Companies would almost certainly argue that limiting the collection and sale of information violates the First Amendment. Such laws, therefore, must be tailored. They should articulate the specific types of data that cannot by retained or sold, and should generally allow citizens to “opt-in” to sharing information once proper disclosures have been made.

The potential benefits of general privacy laws, however, are immense. Unlike an inherently limited, procedural band-aid, they can advance us toward our ultimate goal: a restructuring of the privacy relationship between citizens, the state, and third parties.

Reclaiming personal control

Ultimately, the easiest way to dent the role of third parties in government surveillance is to stop giving them data. Technology can allow citizens to immediately reclaim Fourth Amendment rights, without relying on deliberate legislative change.

Of course, the simplest way to avoid ending up in Google’s location database is to stop carrying a smartphone. This seems unlikely in the short term—particularly if app-based COVID-19 “passports” become part of our transition to a post-pandemic world. There are intermediate alternatives, however. We could opt for smartphones with alternative, open-source operating systems that don’t facilitate spying, and use encrypted messengers that don’t leak information. Moreover, technologies like Freedom Box allow us to keep digital data in the home—where Fourth Amendment rights remain sturdy—rather than on a third-party server.

The uptake of such technologies will not happen overnight. A good first step, however, entails recognizing the extent of constitutional norm-setting that occurs outside political and legal channels. We can let Google make Fourth Amendment-style judgments. Or we can make them ourselves.

An excellent draft. There are insightful points made throughout. Your last two paragraphs are noticeably lighter in substance than the preceding ones, which does a disservice to the quality of the discussion with which you set up the issues that really matter now. Some rebalancing, compressing the introductory portion and using that space for less exiguous discussion of the political and technical openings for progress, would be the best route to improvement, in my view.

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, JohnClayton
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.