This blog post was drafted with help from former EFF Legal Intern Emma Hagemann.

Massachusetts’ highest court has upheld the collection of mass cell tower data, despite recognizing that this data not only provides investigators with “highly personal and private” information but also has the potential to reveal “the locations, identities, and associations of tens of thousands of individuals.”

The case is Commonwealth v. Perry, and in it the Massachusetts Supreme Judicial Court (SJC) addressed the constitutionality of “tower dumps” of cell site location information (CSLI).

 A “tower dump” occurs when a phone company provides law enforcement with data on all devices that connected with a specific cell tower during a specified period of time. Because each cell tower covers a particular geographic area, police can infer from the data that the device owners were in that area at the time. Tower dumps can identify hundreds or thousands of phones—or, in this case, “more than 50,000 individuals . . . without any one of them ever knowing that he or she was the target of police surveillance.”

In Perry, after a series of six store robberies and one homicide, law enforcement sought and obtained two tower dump warrants. Together, the warrants covered seven cell towers on seven different days over the course of a month. Officers cross-referenced the tens of thousands of phone numbers they obtained to identify devices that pinged multiple towers on the days the crimes occurred. Through this process, they were able to identify Mr. Perry as a suspect. Mr. Perry moved to suppress the evidence.

EFF, along with ACLU and the Massachusetts Committee for Public Counsel Services, filed an amicus brief in the case, arguing that a tower dump is a general search that violates the Fourth Amendment and Article 14, Massachusetts’ constitutional equivalent. Like the general warrants reviled by the Constitution’s drafters, tower dumps are irremediably overbroad because they sweep up the information of hundreds or thousands of people that have no connection to the crime under investigation. These searches lack probable cause because the police can’t show a reason to suspect the thousands of innocent people whose information is caught in the dragnet had any link to the crime. They also fail constitutional particularity requirements because the scope of the search is not appropriately limited. We further argued that, even if the court upheld tower dumps, it should impose strict minimization requirements as a safeguard against abuse; the government must demonstrate that the tower dump is necessary and must delete any device data unrelated to the crime as soon as possible. 

Although the court declined to adopt a rule that cell tower dumps are always unconstitutional, it didn't preclude such an argument in a future case. It recognized that these searches not only allow police to track individuals into private, constitutionally-protected areas and, by tracking call data, provide police “significant insight into the individual’s associations,” they also make it possible for police to piece together people’s patterns of behavior. Because the police requested tower dumps in multiple areas over the course of multiple days, the data not only could establish “where an individual was and with whom he or she associated on one occasion, but also where the individual had been and with whom the individual had associated on multiple different occasions.” If a warrant were not sufficiently limited in scope—if it allowed police to select any phone number at random from the 50,000 and determine the identity of that individual, their location, and with whom they had communicated—it would “undoubtedly violate” constitutional particularity requirements.

Nevertheless, the court here held the police had sufficiently limited the scope of the search. Police had reason to believe the crimes were connected and committed by the same people, and police explained in their affidavit supporting the warrant that they had requested multiple tower dumps to look for commonalities among the records—phone numbers that appeared in more than one location. Because one of the warrants also established probable cause to believe the suspect had used a phone in commission of the crime, the court upheld that warrant. The court suppressed the evidence from the other warrant, finding it failed to establish these same facts.

The court did mandate important limitations on these searches going forward. These include requiring a judge to issue the warrant and requiring the warrant to include protocols for the prompt and permanent disposal of any data that is not related to the crime under investigation. However, while these minimization requirements are important, overall, the result in Perry is disappointing. Requiring only that police state that they intend to “identify and/or verify commonalities” in the data on thousands of people is a low bar.

Perry could also have troubling implications for other dragnet search technologies like geofence warrants. The court asserted that the thousands of innocent individuals swept up in a tower dump are not subjected to a “search” in the constitutional sense because, although police collected their data, police didn’t take the further step of analyzing it. Like tower dumps, geofence warrants allow the government to search the location information of many innocent people to try to identify a suspect. Several courts have already recognized the mass privacy violations inherent in geofence data dumps, regardless of whether any police conduct any analysis on the collected data. These courts have ruled geofence warrants are unconstitutional for reasons similar to those we raised in our Perry amicus brief, and we hope that the Supreme Judicial Court would take a fresh look at these arguments if or when it rules on the constitutionality of geofence warrants.

We will continue to challenge cell tower dumps, geofence warrants, and other forms of location surveillance in other cases going forward.