What's Your Expectation of Privacy?

A few years ago, Principal Deputy Director of National Intelligence, Dr. Donald Kerr, said that, "Too often, privacy has been equated with anonymity; and it's an idea that is deeply rooted in American culture."

"In our interconnected and wireless world, anonymity—or the appearance of anonymity—is quickly becoming a thing of the past....Protecting anonymity isn't a fight that can be won."

"We need to move beyond the construct that equates anonymity with privacy and focus more on how we can protect essential privacy in this interconnected environment...Instead, privacy, I would offer, is a system of laws, rules, and customs with an infrastructure of Inspectors General, oversight committees, and privacy boards on which our intelligence community commitment is based and measured."

As I remarked at the time, privacy now means faith in government bureaucracy. A recent news story from the Wall Street Journal is serving to reinforce my view.

According to the WSJ, the U.S. government has been using a cellphone-tracking device generically called a "stingray" to track suspects without their knowledge. The WSJ says the device, which the defense contractor Harris Corp. makes, works by mimicking a cell tower, which gets the cellphone being tracked to "connect" with stingray device whenever the cellphone is powered. Once connected, the cellphone's location can be identified and tracked.

The issue before the U.S. District Court of Arizona is whether a suspect who was tracked in this manner had his Fourth Amendment rights to unreasonable search and seizure violated. The suspect's lawyer wants the FBI to disclose how his suspect was tracked so the information can be used in his defense. However, the U.S. government doesn't want to do so. The WSJ story states:

"The Federal Bureau of Investigation considers the devices to be so critical that it has a policy of deleting the data gathered in their use, mainly to keep suspects in the dark about their capabilities."

The fear is that disclosure of how a stingray (or similar) device works will let suspects figure out ways to thwart them.

When the judge in the U.S. District Court of Arizona asked the government prosecution team whether there were any warrants obtained in connection with the use of the stingray in this case, the prosecutors told the judge that they had gotten a court order that satisfied the language on getting warrants (or not requiring them) to conduct covert surveillance. The judge apparently was suspicious of this answer, for he then asked how could a court order or warrant be obtained from a judge if the judge wasn't told about the technology being used. The prosecutors told the judge,

"It was a standard practice, your honor."

Apparently, the WSJ article reports, it is also standard practice in several states where stingray-type devices are being used. The argument seems to center around the idea that since stingray-like devices don't intercept cell phone communication content, just device location, no wiretapping laws, which would require a warrant, are being broken.

The U.S. District Court of Arizona judge, however, stated that the suspect's lawyer may be able to litigate whether the original court order was "appropriate" or not.

One determination of whether a search or seizure is reasonable is whether there is a reasonable expectation of privacy. A question the courts are now going to have to figure out is whether and when the owner of any mobile device can expect his or her location to be considered private information.

In another case about privacy, in about six weeks, the U.S. Supreme Court is going to be hearing oral arguments (PDF) on whether law enforcement can attach GPS devices to suspects' cars to track them continuously without a warrant. Courts' opinions have been mixed on whether the practice is legal.

Also likely to crop up as a court case in the next few years is whether your employer will be able to use GPS or stingray-type devices to track you in relation to your job. A Wired story from two weeks ago reports that a New York Department of Labor worker found out that the Department had placed a GPS tracking device on his private car and tracked it 24 hours a day for about a month. The Department used the information gathered to claim that the worker was not working where he said he was, which was used as a basis for firing him for misconduct.

The Department of Labor's Inspector General's office placed the GPS on the worker's car after his supervisors requested it, the Wired story says.

In a tangential story, but also related to the privacy of personal information, GM's subsidiary OnStar sent an email to its subscribers about two weeks ago informing them of a change to its privacy policy. According to this story at Bloomberg News, "OnStar told its subscribers...that it may continue collecting information from vehicles that no longer use the service. Customers who cancel the service after Dec. 1 must contact OnStar to stop the company from gathering data under the revised policy."

The OnStar change in its privacy policy sparked a call by New York Senator Charles Schumer and others for the U.S. Federal Trade Commission to investigate OnStar for possible privacy violations in regard to nonsubscribers.

The ensuing outcry by privacy advocates as well as its former customers has forced OnStar to change its policy. It is now saying that it won't track the information of past subscribers. However, current subscribers will still have their information—which is extensive—tracked and possibly sold in the future.

Update: You can listen to a new IEEE Spectrum podcast on the OnStar flap and a discussion with Catherine Crump, a staff attorney with the American Civil Liberties Union’s Speech, Privacy & Technology Project about issues of privacy and surveillance here.