Your smartphone may get you caught up in a ‘geofence warrant’

Smartphone users may not know it, but their mobile devices could allow police and other government agents to track their whereabouts even if they’ve done nothing wrong.

If you have a phone that uses Google apps — an estimated 97% of all smart phones in the world — the government may be able to track your movements if you’ve been near the scene of a crime, a location being investigated or possibly even a protest.

Hacker and cellphone with hologram data.

This is true even if you have no idea about or connection to the crime or investigation. You could be, for example, on the 10th floor of a building on the same street as another place where pharmaceuticals were being stolen on the first floor at a time when hundreds of other people were going about their lives in the same general area that interests investigators. Or maybe you were driving down the street where the crime was being committed indoors.

The way law enforcement can get this information is through something called a “geofence warrant” that investigators can use to get Google to provide data from every mobile device that was in certain places at specific times.

As one federal magistrate described them, geofence warrants “cast a virtual net — in the form of the geofence — around a particular location for a particular time frame.”

The Electronic Frontier Foundation says they’re also called reverse location searches. It describes them as different from typical search warrants:

“Unlike ordinary warrants for electronic records that identify the suspect in advance of the search, geofence warrants essentially work backwards by scooping up the location data from every device that happened to be in a geographic area during a specific period of time in the past. The warrants therefore allow the government to examine the data from individuals wholly unconnected to any criminal activity and use their own discretion to try to pinpoint devices that might be connected to the crime.”

Critics say they’re a modern version of general warrants, which are banned by the Fourth Amendment, historically because government authorities would use them to search anyone and anyplace at will, often to punish political opponents. As the EFF wrote in a court brief, the warrants “give law enforcement license to rummage through individuals’ private spaces.”

Congressman: People would be “terrified to know”

“I think people would be terrified to know that law enforcement could grab general warrants and get everybody’s information anywhere,” said U.S. Rep. Kelly Armstrong, R-ND, while questioning Google’s CEO Sundar Pichai during a U.S. House of Representatives hearing convened during the summer to investigate competition in the tech industry.

Pichai told Armstrong that Google regards the issue as important. Consequently, he said, the company “recently made a change where we automatically delete location information after a certain period of time for our users.” He didn’t elaborate.

Because the warrants are not usually made public, it’s difficult to know precisely how common they are.

According to Armstrong, there was a 1,500% jump in law enforcement’s use of geofence warrants from 2017 to 2018, and a 500% increase from 2018 to 2019. The congressman said that last year, Google received up to 180 geofence warrant requests a week.

Nathaniel Sobel, a legal fellow at EFF, said the “absolute number” of geofence warrants being issued is unclear. “But it definitely seems a lot more are probably granted than we know about in litigation.”

Sobel said Google and law enforcement have shown “very little transparency” regarding geofence warrants and how common they are. It’s not clear if devices, such as iPhones that don’t use Google apps, have technology that is also being used in geofence warrants or something similar.

“Probably just the beginning”

“This is probably just the beginning of this practice,” Sobel said, “and it could spread to many different types of devices and platforms.”

Although they vary, the way geofence warrants generally work is law enforcement will ask a judge to issue a warrant to Google seeking information on everyone in a certain place at a certain time. In response to the warrant, Google provides investigators an anonymized list of the devices with location information that law enforcement can review before seeking more information.

Sobel said law enforcement can then ask for the identities of every person whose phone was caught up in the query or other information that would enable officers to identify the people. It’s not clear if other data from the phones, such as photos, videos, passwords or text messages, is also accessible.

In one case, law enforcement followed up by asking for information about some of the phones’ locations over longer periods of time. Investigators were able to identify a user by seeing tracking information that led back to the person’s home.

The government has also acknowledged that it can use geofence information to generate a list of device identifications that it can easily use to subpoena Google for subscriber identities.

Like going into homes and searching through drawers

Sobel, Kelly and other civil liberties advocates say the warrants are unconstitutional, particularly violating the Fourth Amendment’s prohibition on illegal search and seizure. Specifically, they say, the warrants are the equivalent of general warrants, the kind of authority the founding fathers wrote the Fourth Amendment to curb.

Before the American Revolution, the king’s agents used their general warrant authority to search and seize at will, targeting political opponents and disfavored religious minorities, according to the American Civil Liberties Union. These warrants didn’t require any showing of cause to believe someone had committed a crime.

Under the Fourth Amendment, law enforcement seeking a search warrant is required to provide information supporting its belief that a crime was committed and specifically what it hopes to seize.

Geofence warrants, on the other hand, “are searching literally every single Google account user” in an area over a specific time frame, according to Sobel. “It’s like going into every single person’s house to look through their drawers,” Sobel said, “just to investigate one crime.”

Moreover, because geofence warrants target information about anyone in a particular place at a given time, Sobel said they scoop up data on people who have nothing to do with the investigation at hand.

Could protesters be targeted?

Sobel said so far, the only known cases of geofence warrants have involved criminal investigations. “We haven’t seen any evidence” of their use to gather information about people participating in protests, for example.

But he added, “It is totally possible with this technology to target First Amendment-protected activity and that’s something we’re quite concerned about.” Because of the lack of transparency about the warrants, “It’s accordingly something we’re quite worried about.”

The Reporters Committee for Freedom of the Press has a blog post raising concerns that the warrants could be used against journalists: “Of course, the results can expose sensitive interactions that have nothing to do with the crime police are investigating: a doctor’s visit, say, or a reporter’s interaction with a confidential source,” the post says.

While EFF and other civil liberties legal advocates fight these warrants in court, Armstrong said he hopes Congress can act to prevent the abuses of geofence warrants.

“General warrants in the digital age are the problem,” Armstrong said. The simplest solution, he said, would be to require law enforcement to provide the specific information required for any other search warrant. “That would essentially make these geofence warrants go away,” he said.

Armstrong stressed that he doesn’t fault law enforcement for using geofence warrants. “Law enforcement’s job is to use whatever tools they have,” he said. “Our job is to put the guardrails in place.”

Armstrong said he’s optimistic that the courts will get this issue right. But in the meantime, he said, this is an issue on which both Democrats and Republicans can agree. He said he hopes to start drafting legislation early in the next Congress.

In the meantime, state Senators and Assemblymen in New York have introduced a bill known as the “reverse location search prohibition act” that would ban the use of the warrants by state and local law enforcement.

Two magistrates say warrants unconstitutional

Two federal magistrate judges ruled in August in a case involving pharmaceutical theft that the warrants are unconstitutional, but no higher court has weighed in yet on the geofence issue.

However, the U.S. Supreme Court ruled in 2018 in Carpenter v. United States that an individual’s cell phone location information held by cellular service providers is protected by the Fourth Amendment.

In another of the known legal geofence cases, a different federal magistrate in Chicago issued an order in October that investigators could obtain geofence location information in an arson investigation, concluding that their warrant did not violate the Constitution.

Cases are also being heard in state court in California and federal court in Virginia.

The Virginia case involves an armed robbery of a credit union. The robber got away but was seen on surveillance video holding a cell phone to his ear as he walked into the credit union. The geofence involved an area with a radius of 15 meters around a specific point near the credit union, according to a government brief filed in opposition to a defense motion to suppress evidence. The geofence covered a period of two hours.

After receiving anonymized information about smartphone users in the area, investigators requested more information regarding nine people. One of the people turned out to be the robbery suspect. Investigators obtained his subscriber information, including his email address and Google location history.

Government says geofence warrants aren’t searches

Among other arguments, the government maintained that the geofence warrant wasn’t really a search, but instead a request for business records. “Rather than providing an encyclopedic chronicle of the defendant’s life, the information disclosed by Google provided a summary of his location for less than half an afternoon,” the prosecution filing states. “This information is not quantitatively or qualitatively different from information that could be obtained from other sources, such as surveillance video or live witnesses.”

The information obtained by the warrant was similar to any other business records, according to the government: “For example, credit card records, landline telephone records, employee time sheets, and IP address records may enable law enforcement to retrospectively locate individuals at particular points in time. However, like the geofence information, none of these records provide a comprehensive inventory of the whole of a person’s movements, and the government does not infringe the privacy interest protected by (the Constitution) when it obtains them.”

One of the pharmaceutical theft magistrate orders in Chicago involved three geofence warrants. One warrant covered an area with a radius of 100 meters “in a densely populated city, and the area contains restaurants, various commercial establishments, at least one large residential complex, complete with a swimming pool, workout facilities and other amenities associated with upscale urban living,” according to the order by Magistrate Judge M. David Weisman.

The other two warrants also covered a 100-meter radius in an area that included medical offices and other commercial establishments likely to contain multiple patrons.

The government sought “all of the data of the cellular telephones that accessed Google applications or used Google’s operating system in the three requested geofences.”

Using a phone with Google apps may mean giving up privacy

The government argues that the data being sought through these warrants was provided by the smartphone users to a third party — Google — and that means that legally, the subjects could have no expectation of privacy for their data. This, the prosecution maintained, provided an exception to the protections of the Fourth Amendment.

In other words, as the Supreme Court has held, if a person shares information with someone else, that someone else is free to provide that information to law enforcement without permission from the first person because the first person gave up any expectation of privacy about the information when they shared the information.

The other magistrate, Gabriel A. Fuentes, wrote in his order that he found it “difficult to imagine that users of electronic devices would affirmatively realize, at the time they begin using the device, that they are providing their location information to Google in a way that will result in the government’s ability to obtain — easily, quickly and cheaply — their precise geographical location at virtually any point in the history of their use of the device.”

Weisman dismissed the government’s arguments and wrote that the warrant applications were overbroad and lacked specifics about the data they sought. The judge cited statistics about the increased use of the warrants, adding, “The government’s undisciplined and overuse of this investigative technique in run-of-the-mill cases that present no urgency or imminent danger poses concerns to our collective sense of privacy and trust in law enforcement officials.”

Fuentes elaborated: “The potential to use Google’s capabilities to identify a wrongdoer by identifying everyone (or nearly everyone) at the time and place of a crime may be tempting,” he wrote. “But if the government can identify that wrongdoer only by sifting through the identities of unknown innocent persons without probable cause and in a manner that allows officials to ‘rummage where they please in order to see what turns up,’ … even if they have reason to believe something will turn up, a federal court in the United States of America should not permit the intrusion. Nowhere in Fourth Amendment jurisprudence has the end been held to justify unconstitutional means.”

Contact Elaine Silvestrini at Elaine@legalexaminer.com. Follow her on Twitter at @WriterElaineS.