The Practical Impact of Carpenter v. United States

An enormous amount of attention has been paid to the oral argument before the Supreme Court in Carpenter v. United States. The transcript provides tantalizing tea leaves as to whether the Court will find a protectable right to privacy in a cell phone subscriber’s location and many pundits seem to think the day went to Carpenter while I haven’t heard anyone touting a government homerun.

So I wondered what the practical impact of a government loss would be on the use of location information in criminal investigations based on any prior reporting by wireless carriers of the number of location demands received. To answer that, I looked at the transparency reports of the top four wireless carriers -- the numbers may surprise you.

First, an observation. There isn’t a lot of transparency in wireless carrier reports when it comes to location. At least the carriers report some data, but they are way behind online providers in their transparency reporting detail. The numbers still are staggering.

Second, there isn’t a common lexicon for location demands and types of data to be disclosed. It makes the casual observer wish for more definition and standardization of these reports. So let’s look at what the carriers say and try to compare the data.

Here’s what Verizon said in its report for the first half of 2017:

Location information. Verizon only produces location information in response to a warrant or order; we do not produce location information in response to a subpoena. The laws in some areas of the country require law enforcement to obtain a warrant to get location information, but the laws in other areas permit law enforcement to obtain a court order. In either scenario, the demand we receive for location information is approved by a judge. In the first half of this year, we received approximately 20,442 demands for location data:  about three-quarters of those were through orders and one-quarter were through warrants.

In addition, we received approximately 8,870 warrants or court orders for “cell tower dumps” in the first half of this year.  In order to try to identify a suspect of a crime, the government may apply to a court for a warrant or order compelling us to provide a “dump” of the phone numbers of all devices that connected to a specific cell tower or site during a given period of time.  This tool is being used much more frequently by law enforcement.  We previously reported that in 2013 we received approximately 3,200 warrants or orders for cell tower dumps; we received 14,630 warrants or orders for cell tower dumps in 2016.

So in over 15,000 cases, Verizon disclosed some location information on a court order, not a warrant. Verizon doesn’t disclose whether the demands were for one phone, or many. In my experience, it was common for the government to demand not only the location of the target phone but also the location of all the associates identified in the call records (i.e., who the target called and who called the target) in one order.

Further, Verizon produced tower dumps in 8,870 cases and doesn’t disclose the percentage of warrants to orders in those cases. A tower dump yields the number of every single person registered on that particular tower at a particular time. Orders usually permit the government to obtain the call records of anyone identified in the tower dump without further process. From the data provided, you can’t tell whether the tower dump covered a minute, an hour, a day or longer, or how many users were affected.

Further still, you can’t tell whether the location requests were just for historical records or included real time “pings” to locate a phone or continuous prospective tracking. You can’t determine whether Carpenter should feel good about only being tracked for 127 days because some percentage of the records produced by Verizon covered many more days.  

As a side note, every wiretap includes the tower location at the beginning and end of a call as part of the call identifying information provided automatically. That was decided by the Federal Communications Commission in 1999 and upheld in 2000 by the District of Columbia Circuit Court of Appeals in approving industry wiretap standards under the Communications Assistance for Law Enforcement Act or “CALEA.”  So every call made to or from a target of a wiretap comes with tower location, and those numbers you find in the annual Wiretap Reports.

AT&T’s transparency report is a little less opaque. For the first half of 2017, it says it received 26,941 demands for historical location data; 8,299 real time requests; and 893 tower dump requests for a total of 36,133 demands. But just as with Verizon, it isn’t clear at all how many users are impacted by the disclosures or how many targets are covered by a single order. But at least AT&T offers a little more insight:

A single cell tower demand may cover multiple towers.  We disclose both the total number of demands and the total number of cell tower searches.  For instance, if we received one court order that included two cell towers, we count that as one demand for two searches.  For the 893 cell tower demands during this reporting period, we performed 2,367 searches.  The average time period that law enforcement demanded for a cell tower search was 2 hours and 32 minutes for this reporting period.

AT&T does not disclose how many disclosures are made on court orders alone as opposed to warrants but like Verizon, it would have produced the records just as T-Mobile did in the Carpenter case.

Sprint’s transparency report states that it provided real time location information in 29,868 cases in the first half of 2017.  That’s three orders of magnitude more than AT&T for real time requests. Sprint tells us nothing more about location disclosures such as how many demands it received for historical location.

T-Mobile provides the most explanation for its reporting and it has the largest number of requests of the big 4 carriers. It received 51,557 requests for historical cell site information, 49,157 for prospective location and 4,321 requests for tower dumps. Again, as with all the other providers, the actual number of users affected by the disclosures are not revealed.  

These numbers tell you that location information plays a critical role in government investigations. For that reason alone, I would not discount the government’s chances of winning Carpenter. But these numbers also likely under-report the number of users whose location information has been disclosed and tell you nothing about the periods of time covered by the disclosures. In other words, the magnitude of the privacy impact of location collection on less than a particularized basis simply is unknown.

A myriad of apps and services collect user location today and detailed location profiles are created by platforms and online providers. The government tried hard to distinguish government direct collection of location as in Jones from third party collection from intermediaries and online providers. But in reading the transcript of oral argument, it is hard to find a majority of Justices that agree with the government. While location isn’t quite content, it likely will be treated as a special category exempt from the third party doctrine in the end.

But I don’t think the carrier numbers will change all that much. The government will still find location tracking essential to their investigations and will write affidavits to get the necessary warrants. Carpenter’s counsel conceded at oral argument that tower dumps and emergency requests would be unaffected by the Court’s decision. In short, the practical effect of a government loss may be negligible.