A few years ago, Principal Deputy Director of National Intelligence, Dr. Donald Kerr, said that, "Too often, privacy has been equated with anonymity; and it's an idea that is deeply rooted in American culture."
"In our interconnected and wireless world, anonymity—or the appearance of anonymity—is quickly becoming a thing of the past....Protecting anonymity isn't a fight that can be won."
"We need to move beyond the construct that equates anonymity with privacy and focus more on how we can protect essential privacy in this interconnected environment...Instead, privacy, I would offer, is a system of laws, rules, and customs with an infrastructure of Inspectors General, oversight committees, and privacy boards on which our intelligence community commitment is based and measured."
As I remarked at the time, privacy now means faith in government bureaucracy. A recent news story from the Wall Street Journal is serving to reinforce my view.
According to the WSJ, the U.S. government has been using a cellphone-tracking device generically called a "stingray" to track suspects without their knowledge. The WSJ says the device, which the defense contractor Harris Corp. makes, works by mimicking a cell tower, which gets the cellphone being tracked to "connect" with stingray device whenever the cellphone is powered. Once connected, the cellphone's location can be identified and tracked.
The issue before the U.S. District Court of Arizona is whether a suspect who was tracked in this manner had his Fourth Amendment rights to unreasonable search and seizure violated. The suspect's lawyer wants the FBI to disclose how his suspect was tracked so the information can be used in his defense. However, the U.S. government doesn't want to do so. The WSJ story states:
"The Federal Bureau of Investigation considers the devices to be so critical that it has a policy of deleting the data gathered in their use, mainly to keep suspects in the dark about their capabilities."
The fear is that disclosure of how a stingray (or similar) device works will let suspects figure out ways to thwart them.
When the judge in the U.S. District Court of Arizona asked the government prosecution team whether there were any warrants obtained in connection with the use of the stingray in this case, the prosecutors told the judge that they had gotten a court order that satisfied the language on getting warrants (or not requiring them) to conduct covert surveillance. The judge apparently was suspicious of this answer, for he then asked how could a court order or warrant be obtained from a judge if the judge wasn't told about the technology being used. The prosecutors told the judge,
"It was a standard practice, your honor."
Apparently, the WSJ article reports, it is also standard practice in several states where stingray-type devices are being used. The argument seems to center around the idea that since stingray-like devices don't intercept cell phone communication content, just device location, no wiretapping laws, which would require a warrant, are being broken.
The U.S. District Court of Arizona judge, however, stated that the suspect's lawyer may be able to litigate whether the original court order was "appropriate" or not.
One determination of whether a search or seizure is reasonable is whether there is a reasonable expectation of privacy. A question the courts are now going to have to figure out is whether and when the owner of any mobile device can expect his or her location to be considered private information.
In another case about privacy, in about six weeks, the U.S. Supreme Court is going to be hearing oral arguments (PDF) on whether law enforcement can attach GPS devices to suspects' cars to track them continuously without a warrant. Courts' opinions have been mixed on whether the practice is legal.
Also likely to crop up as a court case in the next few years is whether your employer will be able to use GPS or stingray-type devices to track you in relation to your job. A Wired story from two weeks ago reports that a New York Department of Labor worker found out that the Department had placed a GPS tracking device on his private car and tracked it 24 hours a day for about a month. The Department used the information gathered to claim that the worker was not working where he said he was, which was used as a basis for firing him for misconduct.
The Department of Labor's Inspector General's office placed the GPS on the worker's car after his supervisors requested it, the Wired story says.
The ensuing outcry by privacy advocates as well as its former customers has forced OnStar to change its policy. It is now saying that it won't track the information of past subscribers. However, current subscribers will still have their information—which is extensive—tracked and possibly sold in the future.
Update: You can listen to a new IEEE Spectrum podcast on the OnStar flap and a discussion with Catherine Crump, a staff attorney with the American Civil Liberties Union’s Speech, Privacy & Technology Project about issues of privacy and surveillance here.
Robert N. Charette is a Contributing Editor to IEEE Spectrum and an acknowledged international authority on information technology and systems risk management. A self-described “risk ecologist,” he is interested in the intersections of business, political, technological, and societal risks. Charette is an award-winning author of multiple books and numerous articles on the subjects of risk management, project and program management, innovation, and entrepreneurship. A Life Senior Member of the IEEE, Charette was a recipient of the IEEE Computer Society’s Golden Core Award in 2008.