Police seizing of text messages violated 4th Amendment, a judge has ruled.

Rhode Island - At 6:08am, on October 4, 2009, Trisha Oliver frantically called 911 from her apartment in Cranston, Rhode Island when her six-year-old son, Marco Nieves, stopped breathing. The Fire Department took Marco to Hasbro Children's Hospital, where he was found to be in full cardiac arrest. He died 11 hours later.

By 6:20am, Sgt. Michael Kite of the Cranston Police Department had arrived at the apartment, where he found Oliver, her boyfriend Michael Patino, and their 14-month-old daughter, Jazlyn Oliver. Kite observed a couple of stripped beds and linens on the floor, a trash can with vomit inside it, dark brown vomit in a toilet, and, crucially, a cell phone on the kitchen counter. Kite picked up the cell phone, and it was at that point—in the just-released opinion of a Rhode Island state court—that police proceeded to mangle a murder case and violate Patino's Fourth Amendment rights by viewing text messages without a warrant.

Kite viewed a text message on the phone, which was owned by Trisha Oliver, reading "Wat if I got 2 take him 2 da hospital wat do I say and dos marks on his neck omg." The message was sent from Oliver to Patino, although the sending of the message apparently failed. There were other messages on the phone "with profane language and references to punching Marco—three times—the hardest of which was in the stomach," according to court records. Patino was arrested and charged with murder.

Kite claims he picked up the phone because it was "beeping," and that he thought it might help get in touch with the boy's birth father. But yesterday, Rhode Island Superior Court Associate Justice Judith Savage threw out nearly all of the evidence police collected from that point on, including the contents of cell phones, phone records and communications provided by Verizon, T-Mobile, and Sprint Nextel, landline phone records, and even Patino's "confession for the death of Marco Nieves." Savage said almost all the evidence obtained by police was "tainted by the illegal search made by Sgt. Kite or the other illegal searches and seizures of cell phones and their contents."

Patino is fighting the case both on Constitutional grounds and on the facts. He says the injuries to the boy were an accidental result of horsing around.

Savage's decision in State of Rhode Island v. Michael Patino is a bold and interesting one, because the status of text messages in criminal investigations remains unsettled in the US. Savage wrote "this Court finds that it is objectively reasonable for people to expect the contents of their electronic text messages to remain private, especially vis-à-vis law enforcement." Patino had a right to privacy for his text message conversations, whether police took them from his phone or Oliver's, and a right to privacy in the apartment because he frequently stayed there, making it one of his residences.
http://www.courts.ri.gov/Courts/SuperiorCourt/DecisionsOrders/decisions/10-1155.pdf

"Based on the tsunami of illegal evidence collected by the Cranston Police Department, this Court grants Defendant‘s suppression motions and excludes the State‘s core evidence from being used at trial, including the text messages, all cell phones and their contents, all cell phone records, and critical portions of the Defendant‘s videotaped statement and his written statement given to the police," Savage wrote. "In addition, this Court finds that the Defendant made a preliminary showing that numerous sworn statements made by police officers in a dozen warrant affidavits were either deliberately false or made in reckless disregard of the truth so as to entitle him to a Franks hearing subject to further argument on additional preliminary issues."

The cell phone searches were "illegal as warrantless or in excess of the warrants obtained," and "As such, all of these searches and seizures, therefore, were unreasonable in violation of the Fourth Amendment," the judge wrote.

Savage reasoned that cell phone contents are deserving of Fourth Amendment protection against unreasonable searches and seizures because people generally keep them on their person at all times. "Text messages are often raw, unvarnished, and immediate; revealing the most intimate of thoughts and emotions to those who are expected to guard them from publication," she wrote, further stating that the court "does not find that the remote possibility that an unintended party will receive a text message due to his or her possession of another person‘s cell phone is sufficient to destroy an objective expectation of privacy in such a message."
http://arstechnica.com/tech-policy/2012/09/police-seizure-of-text-messages-violated-4th-amendment-judge-rules/

Feds say mobile-phone location data not ‘Constitutionally protected’

The Obama administration told a federal court Tuesday that the public has no “reasonable expectation of privacy” in cellphone location data, and hence the authorities may obtain documents detailing a person’s movements from wireless carriers without a probable-cause warrant.

The administration, citing a 1976 Supreme Court precedent, said such data, like banking records, are “third-party records,” meaning customers have no right to keep it private. The government made the argument as it prepares for a re-trial of a previously convicted drug dealer whose conviction was reversed in January by the Supreme Court, which found that the government’s use of a GPS tracker on his vehicle was an illegal search.

With the 28 days of vehicle tracking data thrown out of court, the feds now want to argue in a re-trial that it was legally in the clear to use Antoine Jones’ phone location records without a warrant. The government wants to use the records to chronicle where Jones was when he made and received mobile phone calls in 2005.

“A customer’s Fourth Amendment rights are not violated when the phone company reveals to the government its own records that were never in the possession of the customer,” the administration said in a court filing Tuesday (.pdf). ”When a cell phone user transmits a signal to a cell tower for his call to be connected, he thereby assumes the risk that the cell phone provider will create its own internal record of which of the company’s towers handles the call. Thus, it makes no difference if some users have never thought about how their cell phones work; a cell phone user can have no expectation of privacy in cell-site information.”

The government’s position comes as prosecutors are shifting their focus to warrantless cell-tower locational tracking of suspects in the wake of a Supreme Court ruling (.pdf)  in Jones’ case that law enforcement should acquire probable-cause warrants from judges to affix GPS devices to vehicles.

Just after the Jones decision, the FBI pulled the plug on 3,000 GPS-tracking devices.

Jones, as one might suspect, wants the court to find that the feds should get a probable cause warrant for phone records, too.

“In this case, the government seeks to do with cell site data what it cannot do with the suppressed GPS data,” Jones’ attorney Eduardo Balarezo wrote (.pdf) U.S. District Judge Ellen Huvelle.

The government does not agree.

“Defendant’s motion to suppress cell-site location records cannot succeed under any theory. To begin with, no reasonable expectation of privacy exists in the routine business records obtained from the wireless carrier in this case, both because they are third-party records and because in any event the cell-site location information obtained here is too imprecise to place a wireless phone inside a constitutionally protected space,” the administration wrote the federal judge presiding over the Jones re-trial.

Just as the lower courts were mixed on whether the police could secretly affix a GPS device on a suspect’s car without a warrant, the same is now true about whether a probable-cause warrant is required to obtain so-called cell-site data. During the investigation, a lower court judge in the Jones case authorized the five months of the cell-site data without probable cause, based on government assertions that the data was “relevant and material” to an investigation.
http://www.wired.com/threatlevel/2012/09/feds-say-mobile-phone-location-data-not-constitutionally-protected/

District Court rules the Wiretap Act doesn't prohibit intercepting unencrypted wireless communications.

The decision is In re INNOVATIO IP VENTURES, LLC PATENT LITIGATION. MDL Docket No. 2303, Case No. 11 C 9308. (N.D.Ill. August 22, 2012), via Cybercrime Review. The opinion holds that anyone can monitor the unencrypted wi-fi communications of anyone else without implicating the Wiretap Act. I think the decision is wrong, and I wanted to explain why.

The court holds that unsecured wireless communications are not covered by the Wiretap Act because of the exception found in 18 U.S.C. § 2511(g)(i). That exception states:

(g) It shall not be unlawful under this chapter or chapter 121 of this title for any person—
(i) to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public;

The Court concludes that this exception covers unsecured wi-fi communications, so that it is entirely lawful to snoop in on someone else’s private communications over an unsecured wireless network:

Innovatio is intercepting Wi-Fi communications with a Riverbed AirPcap Nx packet capture adapter, which is available to the public for purchase for $698.00. See Riverbed Technology Product Catalog, http://www.cacetech.com/products/catalog/ (last visited Aug. 21, 2012). A more basic packet capture adapter is available for only $198.00. Id. The software necessary to analyze the data that the packet capture adapters collect is available for down load for free. See Wireshark Frequently Asked Questions, http://www.wireshark.org/faq.html#sec1 (last visited Aug. 21, 2012) (“Wireshark® is a network protocol analyzer. . . . It is freely available as open source. . . .”). With a packet capture adapter and the software, along with a basic laptop computer, any member of the general public within range of an unencrypted Wi-Fi network can begin intercepting communications sent on that network. Many Wi-Fi networks provided by commercial establishments (such as coffee shops and restaurants) are unencrypted, and open to such interference from anyone with the right equipment. In light of the ease of “sniffing” Wi-Fi networks, the court concludes that the communications sent on an unencrypted Wi-Fi network are readily available to the general public.

I don’t think that’s right. Look closely at the text: “configured so that such electronic communication is readily accessible to the general public.” In my view, that text focuses on the intent of the designer — the person who does the configuring of the network so that it works a particular way — to design the network so that the general public was supposed to be able to access them. Of course, you might not know the actual intent of the designer with 100% certainty. But with many technologies, it’s obvious what counts as an expected use and what counts as an unexpected use. Cf. United States v. Morris, 928 F.2d 504 (2d. Cir. 1991) (creating an “intended function” test to distinguish authorized access to a network from unauthorized access to a network). No one suggests that unsecured wireless networks are set up with the goal that everyone on the network would be free to read the private communications of others. In my view, that ends the matter: the exception doesn’t apply, and the interception of the contents of wireless communications is covered by the Wiretap Act.

An analogous issue arose in Tapley v. Collins, 41 F.Supp.2d 1366 (S.D.Ga. 1999), which involved listening in on cordless telephone calls that were broadcast by cordless phones and (back then) not encrypted. The Tapley court held that this exception did not permit the interception of unencrypted cordless telephone calls:

This subdivision . . . obviously contemplates the use of scanners to intercept (a) police, fire and emergency radio traffic; along with (b) any other electronic communications the designers and users of which—from decades of experience—have no reasonable grounds to expect anything but casual, even wide-scale interception by others (e.g., “CB radios”).

In contrast, cordless telephones were never designed with that intent. True, early versions were prone to substantial electronic “leakage,” leading courts and Congress alike to conclude that no one could reasonably claim a right to privacy when using them. See Spetalieri, 36 F.Supp.2d at 113; Peavy, 37 F.Supp.2d at 505–06. But no one has argued that cordless phone manufacturers intended, or were even lax about, any “incidental broadcast” feature.

That’s right, I think. The issue under 2511(2)(g)(i) is what the designers intended users to be able to do, not what someone can do contrary to the designer’s intentions.

Consider the implications of a contrary rule by focusing on the example of communications over a wire. You can buy a KeyKatcher keylogger for $55 from Amazon (with free super saver shipping!) and install it on a wire of Internet traffic. It’s a lot cheaper than the wireless packet capture devices the Court is focused on in its decision. Under the Court’s decision, the Wiretap Act categorically should not apply to that quintessential act of wiretapping whenever the wire was itself available to the public simply because anyone can buy the $55 device and install it. In my view, that can’t be the test: The issue is not whether a member of the public could engage in the wiretapping as a matter of cost and practicality, but rather whether the technology is set up consistently with a design that reflects an intent that members of the public would be able to monitor those communications.

Two final points. First, my sense is that the court did not need to reach this legal question in the first place. The case is a patent dispute rather than a wiretapping case, and there is no suppression remedy because the communications are electronic communications (and the statutory suppression remedy only applies to wire and oral communications). Second, a much more difficult question is the one presented in In re Google Inc. Street View Electronic Communications Litigation, 794 F. Supp. 2d 1067, 1070 (N.D. Cal. 2011): Does the “radio communication” exception in 18 U.S.C. 2511(2)(g)(ii) exempt wireless communications from the Wiretap Act? That issue is now on appeal before the Ninth Circuit in the Google Street View case, and I think Judge Ware was correct to conclude that the exception does not apply. But whatever you think is the right answer to that question, I think it’s the more difficult issue.
http://www.volokh.com/2012/09/06/district-court-rules-that-the-wiretap-act-does-not-prohibit-intercepting-unencrypted-wireless-communications/