United States v. Chatrie - geofence warrants and the Fourth Amendment

[pmbug]

... the Fourth Circuit held oral argument in the case ...
...
It was a somewhat unusual argument, in that the judges spent a lot of time expressing their views and arguing amongst each other. In general, though, I thought it went well for the government. I would guess they prevail 2-1.

Judge Richardson seemed to be a vote on the government's side, and on the broadest ground. He suggested that there was no Fourth Amendment protection in the specific records known as "Google Location History" because you need to opt in to have Google collect them. Only about 1/3 of Google customers opt in to that. And to Judge Richardson, that was outcome determinative: If Google only keeps these particular records if you opt in, then you have volunteered to have those records and the third party doctrine applies.
...
Judge Wynn was clearly on the defense side. He thought this was extremely disturbing surveillance. He analogized this authority to what you might expect in Nazi Germany. He also argued that that opting in is a fiction. There is no real option, in his view.
...

More:

The First Geofence Warrant Case Reaches the Federal Court of Appeals

In March 2022, I had a long post on the district court's ruling in United States v. Chatrie, the first...

reason.com

 

[Goldhedge]

Maybe I'm the only one, but they never said what a geofence warrant is....

A geo-fence warrant (also known as a geofence warrant or a reverse location warrant) is a search warrant issued by a court to allow law enforcement to search a database to find all active mobile devices within a particular geo-fence area. Courts have granted law enforcement geo-fence warrants to obtain information from databases such as Google's Sensorvault, which collects users' historical geolocation data.[1][2] Geo-fence warrants are a part of a category of warrants known as reverse search warrants.[3]

Geo-fence warrant - Wikipedia

en.wikipedia.org

 

[pmbug]

I guess publicity of the issue has impacted Google's braintrust:

... Google will no longer keep location history even for the users who opted in to have it turned on. Instead, the location history will only be kept on the user's phone.
...

Did Google Just Defeat Every Geofence Warrant?

Code is law, they say.

reason.com

Google won't collect the data, so they can't be compelled to obey geofence warrants. Changes to roll out through next year for Android devices.

 

[pmbug]

Google announced this week that it will be making several important changes to the way it handles users’ “Location History” data. These changes would appear to make it much more difficult—if not impossible—for Google to provide mass location data in response to a geofence warrant, a change we’ve been asking Google to implement for years.
...
However, we are not yet prepared to declare total victory. Google’s collection of users’ location data isn’t limited to just the “Location History” data searched in response to geofence warrants; Google collects additional location information as well. It remains to be seen whether law enforcement will find a way to access these other stores of location data on a mass basis in the future. Also, none of Google’s changes will prevent law enforcement from issuing targeted warrants for individual users’ location data if police have probable cause to support such a search.

But for now, at least, we’ll take this as a win. It’s very welcome news for technology users as we usher in the end of 2023.

Is This the End of Geofence Warrants?

Google announced this week that it will be making several important changes to the way it handles users’ “Location History” data. These changes would appear to make it much more difficult—if not impossible—for Google to provide mass location data in response to a geofence warrant, a change we’ve...

www.eff.org

Number 6: Where am I?

Number 2: In the Village.

Number 6: What do you want?

Number 2: Information.

Number 6: Whose side are you on?

Number 2: That would be telling. We want information... information... information.

Number 6: You won't get it.

Number 2: By hook or by crook, we will.

 

[pmbug]

Epic.org isn't letting Google off the hook:

January 18, 2024

In a complaint filed today, the Electronic Privacy Information Center (EPIC) and Accountable Tech called on the Federal Trade Commission to investigate tech giant Google for failing to promptly delete location records of users’ visits to abortion clinics and other sensitive facilities despite publicly promising it would do so.

Google retains and processes vast troves of personal information collected through its many applications, programs, and partners. This includes massive amounts of location data, which can reveal sensitive details about a person—including health information like whether and when a person visited a doctor’s office, an addiction treatment center, or an abortion clinic. When this information is retained by companies like Google, it can be accessed by law enforcement and can be used to profile individuals in harmful ways.

In July 2022, following the U.S. Supreme Court’s rescindment of the constitutional right to abortion in Dobbs v. Jackson Women’s Health Organization, Google announced a major policy change to its handling of location data. Google stated that if “its systems identified that a user had visited” an abortion clinic, it would “delete these entries from Location History soon after they visit.” Google’s commitment also extended to location records identifying a user’s visits to addiction treatment centers, domestic violence shelters, and other similarly sensitive facilities.

But Google broke that promise. Months later, research by Accountable Tech and others showed that Google had failed to delete the location information it had promised to. For example, Google’s systems retained search queries and directions to Planned Parenthood clinics and granular map data placing users at Planned Parenthood locations they had visited for more than a month. And the problem continues to this day: a follow-up experiment from Accountable Tech found that while Google had scrubbed “Planned Parenthood” from a user’s Location History map, it retained the route to the clinic itself in four out of eight of its tests. Although Google recently promised—again—to extend enhanced protections to users’ location data, it has yet to follow through on the deletion promise it made more than a year ago, leaving users vulnerable to privacy harms.

“Google’s personal location data practices have caused or are likely to cause substantial injury to its users because they expose users to excessive retention of their ‘particularly personal’ information that can reveal highly sensitive information about them, including whether an individual visited a medical treatment facility, domestic violence shelter, abortion clinic, fertility center, addiction treatment facility, or a surgery clinic.,” EPIC and Accountable Tech’s complaint explains. “The ability of law enforcement to access such data can lead to criminal prosecution and unduly discourage individuals from seeking vital health care services—a risk of substantial injury that has dramatically increased following the Dobbs ruling.”

The complaint calls on the FTC to investigate Google for unfair and deceptive practices in violation of Section 5 of the FTC Act and for violating the 2011 FTC Consent Order arising from Google’s previous mishandling of personal data in the rollout of the Google Buzz social network. EPIC and Accountable Tech are urging the FTC to impose civil penalties, order Google to disgorge wrongfully retained location data, and enjoin Google’s unlawful location data practices.

“These harmful practices show us why we cannot rely on pinky promises from Google to protect our most sensitive information,” EPIC Counsel Sara Geoghegan said. “The FTC and Google have recognized the serious harms that stem from excessive data retention, and it is critical for the Commission to step in to hold Google accountable for these violations.”

“Google can’t have it both ways. If the company wants the reputation of being strong on privacy protection, it must live up to its commitments – not merely pay them lip service,” said Kaili Lambe, Policy and Advocacy Director at Accountable Tech. “But over and over again Google has broken its promises, risking the personal data of the people who rely on its services. Google can’t be trusted, which is why we’re asking the FTC to investigate.”
...

PRESS RELEASE: EPIC, Accountable Tech Urge FTC to Investigate Google’s Failed Promise to Delete Sensitive Location Data

epic.org