Hacker News Reader

"In other words, if cell phone service providers were taking their customers' privacy (and constitutional rights) seriously, then this Supreme Court case should actually be the government suing a cell phone service provider for not turning over customer data in a case where a warrant has not been issued. "

As much as i hate the cell phone providers, they are fairly screwed here.

See, https://en.wikipedia.org/wiki/Communications_Assistance_for_...

and

https://en.wikipedia.org/wiki/Stored_Communications_Act

and friends.

>The larger question, though, is not whether police should be required to obtain a warrant to access location data from cell phone service providers, but whether cell phone service providers should be providing this information to police without a warrant.

It's not really about whether they can provide this information to the police without a warrant. They can. The 4th Amendment doesn't protect against someone sharing your secrets voluntarily.

But this wasn't a voluntary sharing of information. It's done by a government order under the Shared Communications Act. Under current Court precedence this law is constitutional, but there are decent arguments was wrong when it decided that.

Thanks for the summary.

One other thing that should be scrutinized in general: correlating cell phone location with actual person location is used as concrete admissible evidence.

Another consideration: how can one challenge this evidence on-par with an hope of success? I imagine personal records showing discrepancies or outright fabrication on the carrier's part would not easily be accepted.

Finally, the carrier was provided, but the phone itself wasn't identified. Was this a dumb phone, Android or iOS device? Does it matter?

>Finally, the carrier was provided, but the phone itself wasn't identified. Was this a dumb phone, Android or iOS device? Does it matter?

It does not matter. Every carrier maintains a list of connected to towers for a month or more. This is the data those companies would be providing to LEO.

Another consideration: How easy is it to spoof a sim card? Someone might be trying to implicate the accused by duplicating their sim card and taking a phone with the duplicated sim card to every robbery they commit.

> Another consideration: How easy is it to spoof a sim card?

Spoof? No. You can clone a card if you get physical access to it and it uses the older COMP128v1 encryption as the key is just 56-bit to bruteforce. This allows you to use their IMSI.

You'd also need to spoof the IMEI of the target device, which can only be done easily on older phones (original iPhone with early baseband is one) or with custom built solutions (think SDR, hackrf stuff)

I am fairly certain most major US carriers are not using the old-style SIM card anymore for this very reason. To support 3G and later on LTE, the cards would have to be upgraded.

this will fly likely under the same rules as red light cameras which send a ticket to the owner regardless of who is driving. you "car/phone/spirit/thoughts" were there so you are considered there.

going to be interesting if the government loses the case if rules and regulation are pushed through Congress mandating availability. they could try to declare it public property since it does pass through public airspace/radio space. all sorts of angles they can push. (its coming, just when and with what protections for our privacy will be most important)

> this will fly likely under the same rules as red light cameras which send a ticket to the owner regardless of who is driving. you "car/phone/spirit/thoughts" were there so you are considered there

In most states, the red light ordinance makes the driver liable, not the owner. There is no "you were there in proxy" rule of the sort you suggest. The law merely creates a rebuttable presumption that the owner was driving. Also, Courts have upheld the presumption because red light tickets are civil infractions, not criminal penalties. The due process clause recognizes that the amount of process "due" (i.e. warranted, or appropriate in a given context) depends on the magnitude of the deprivation of property rights at issue. Civil infractions thus create lower due process concerns than criminal cases.

In this case, there was no similar presumption along the lines of: "your phone was here, therefore you were here." It was simply circumstantial evidence of the sort regularly used in criminal prosecutions (e.g. your business card was found at the murder scene).

The real concern here is an evidentiary issue. Cell tower tracking isn't very precise. Courts need to make sure that the jury appropriately understands the lack of precision in the data. Courts are often very bad at this. E.g. courts often don't permit defendants to argue to the jury that, even though the probability of a false random match in DNA testing is remote in theory, in practice the odds of wrong results due to lab error are astronomically higher (almost 1 in 100).

Although the point I think you're making is pretty much true for all circumstantial evidence. Sure maybe someone who looks like you took your car for a drive in the middle of the night while you were sleeping, but absent a plausible alternative theory, a jury is going to be skeptical. There often aren't smoking guns.

If you are going to commit a crime, just leave your phone at home. Then you could say, "I wasn't there!"

The providers are responsible for their customer's privacy, to whatever extent is laid out in the contract, so I could see a grounds for some sort of liability there. But I don't see how the company is responsible for their customer's constitutional rights. I would think that that question should be more about whether the government actors can ask for and use that data.

It's worse than you may think. They generally will not have standing to sue the government for violating their customers rights. Only the customers would have standing to sue

Well, that's an easy one: leave your cell phone at home when commiting a crime.

Won't Stringray devices provide similar data without a warrant? Seems like there is already a workaround for this?

The Stingray is legally grayer. Carrier data is squarely within the third party doctrine.[1] The fourth amendment protects individuals' rights in "their persons, houses, papers, and effects." A carrier's billing records are not your papers and effects; they're the carrier's property, generated by the carrier for the carrier's own internal purposes.[1]

The Stingray, however, interacts directly with the suspect's cell phone. Third party doctrine becomes irrelevant at that point, and the government has to fall back to arguing that whatever a Stingray does is not a "search" or a "seizure."

[1] Doesn't mean the Supreme Court won't limit third party doctrine in this case.

[2] Say some nosy neighbor keeps a list every person that enters or leaves a house in a neighborhood. The resident of the house is murdered. The nosy neighbor's list shows that you entered the house the day of the murder. You can't assert a 4th amendment right as to the nosy neighbor's list. It's a paper that's about you, but it's not your paper.

The cost to deploy a Stingray is still significantly higher, which may be a factor.

If anyone else was curious, the cell phone providers in this case were "MetroPCS & Sprint".