When it comes to the highest court in Massachusetts, it sometimes seems like entire battles are won and lost in the footnotes. In a seemingly straightforward new case, the Supreme Judicial Court has managed to add a wrinkle on top of the already complicated patchwork of law surrounding cell phone location tracking. The court’s opinion today in Commonwealth v. Estabrook sets out what it calls a “bright-line rule” and reaffirms that, in general, the Massachusetts constitution requires a warrant for tracking a person’s location using cell site location information (CSLI). That’s worth celebrating, but cynical readers who are already wondering about the “in general” in the previous sentence should take a look at footnote twelve in the opinion. Meanwhile, all readers should probably buckle in for a somewhat detailed tale of judicial incrementalism.
Estabrook is the successor to an earlier decision by the Supreme Judicial Court called Commonwealth v. Augustine. In both cases, police obtained several weeks of so-called historical CSLI about the defendants, revealing their movements over that period. In Augustine, following arguments made by EFF in an amicus brief, the court established that individuals have an expectation of privacy under the Massachusetts constitution in their past movements revealed by historical CSLI. However, the court also noted that it was “likely” that “there is some period of time” that was “too brief to implicate the person's reasonable privacy interest” and trigger the state constitution’s warrant requirement. In a fateful footnote, it added that “it would be reasonable to assume that a request for historical CSLI of the type at issue in this case for a period of six hours or less would not require the police to obtain a search warrant.
In Estabrook, EFF and the ACLU of Massachusetts filed an amicus brief represented by Harvard Law School’s Cyberlaw Clinic. As we explained, the Augustine loophole seemingly allowing the warrantless collection of six hours of CSLI was irrelevant to Estabrook’s case, because the police obtained two weeks of CSLI about him. Two weeks is two weeks, even if the police were ultimately interested only in a critical six-hour period around the time of the murder Estabrook was on trial for. The court agreed with our argument precisely:
[I]n terms of reasonable expectation of privacy, the salient consideration is the length of time for which a person's CSLI is requested, not the time covered by the person's CSLI that the Commonwealth ultimately seeks to use as evidence at trial. . . . It would violate the constitutional principles underlying our decision in Augustine to permit the Commonwealth to request and obtain without a warrant two weeks of CSLI—or longer—so long as the Commonwealth seeks to use evidence relating only to six hours of that CSLI.
It’s nice to see a court acknowledge the realities of modern surveillance. Too often law enforcement and intelligence agencies successfully argue that they should be able to access large amounts of private information as long as they only use a smaller amount. This argument equates privacy with government-written “minimization procedures.” But as the Supreme Court held last year in Riley v. California, our constitutional rights to privacy protect against overcollection too.
One key way courts put this into practice is by creating bright-line rules that signal to the police and citizens alike what is covered by the warrant requirement. Our Estabrook amicus brief argued that the court should close the Augustine loophole and require a warrant for all CSLI, even for fewer than six hours. Small amounts of location information can be very revealing, and other courts and state legislatures have required warrants across the board. But the court disagreed, describing the Augustine six-hour line as suitably clear.
So clear, in fact, that the court decided it could risk muddying things up again. In a new footnote, it explained that the six-hour exception to the requirement applies only to the “telephone call” variety of CSLI at issue in Estabrook, not “registration” CSLI. The difference is that call CSLI only provides a cell phone user’s location during calls, whereas registration CSLI is created automatically every few seconds when the phone “pings” a nearby cell tower.
Registration CSLI obviously generates a more complete and revealing picture of users’ movements than call CSLI, especially given millennials’ well-known phobia for actually talking on the phone. But that’s hardly enough to serve as the basis for a constitutional rule. Why should you have more protection when you walk around playing Words with Friends than when you actually exchange some words with a friend over the phone?
It’s also very hard to see how this footnoted bright-line rule provides actual clear guidance to the police. Are they supposed to generate warrantless requests to the cell phone providers that ask solely for call CSLI and not registration CSLI? It’s far from clear that the providers could handle such requests, or that courts or defense attorneys in routine cases are technically equipped to sort out the one from the other. The police in Massachusetts should recognize that the most prudent course after Estabrook is to make getting a warrant standard practice.
All of this counsels for a true bright-line rule: a warrant requirement for all CSLI. That’s the rule the Fourth Circuit reached in United States v. Graham, and the rule EFF is urging the Supreme Court to adopt if it agrees to review a contrary decision by the Eleventh Circuit in United States v. Davis. Meanwhile, Massachusetts is also considering whether to legislate for more location privacy protections. We hope they’ll see the wisdom of clear, footnote-free rules.
