Many Americans reacted with outrage when they learned that the NSA stores details about phone calls made by virtually everyone in the United States. They felt a strong, if vague, notion that the practice must violate their constitutional rights. Couldn't NSA analysis of telephone metadata reveal sensitive, private details about most anyone in the country, like their network of friends, the identity of their sexual partners, or their contact with medical or mental health professionals? Aren't mass searches of innocents anathema to the Fourth Amendment?
The legal response from NSA defenders has leaned heavily on the precedent set in Smith v. Maryland, a Supreme Court case decided in 1979, before the era of big data.
The case concerned a robbery. Patricia McDonough, the victim, noticed a 1975 Monte Carlo near the scene of the crime. Later she received obscene phone calls from a man who claimed to be the robber. Once he asked the victim to step out onto her porch, where she saw the Monte Carlo drive slowly by. Soon after, police spotted a man driving the Monte Carlo in the victim's neighborhood. After tracing its license plate to Michael Lee Smith, officers went to the phone company and asked them to put a pen register on his phone. The resulting phone records showed that he called the victim's house. At trial, he tried to suppress that evidence, arguing that the police should have gotten a warrant before having the phone company track the numbers he dialed.
He lost at the Supreme Court. In the majority opinion, Justice Harry Blackmun invoked a test articulated in a previous case, Katz v. United States. It declared that, for Fourth Amendment purposes, a search only occurs when a citizen has a reasonable expectation of privacy.
Did the robber who used his home phone to call his victim have that? "We doubt that people in general entertain any actual expectation of privacy in the numbers they dial," Blackmun wrote. "All telephone users realize that they must 'convey' phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. All subscribers realize, moreover, that the phone company has facilities for making permanent records of the numbers they dial, for they see a list of their long-distance calls on their monthly bills."
* * *
The Fourth Amendment confers not "a right to privacy," but a right to be secure against "unreasonable searches and seizures." The NSA's defenders argue that, under the precedent set in Smith v. Maryland, the NSA is not conducting unreasonable searches, because the tens of millions of Americans whose telephone data it hoovers up and stores have no expectation of privacy in who they call. By this logic, even if the federal government used powerful computers to look through the phone calls of tens of millions of people and fully mapped the associations of every last American, based on all phone calls made over the last five years, their conduct still wouldn't count as a search for the purposes of the Fourth Amendment, even if they also published a list of everyone who dialed up a therapist, a divorce attorney, a suicide hotline, an Islamic charity, or the ACLU or NRA!
In contrast, if the government eavesdropped on the content of even a single telephone call without a warrant, that would be a violation of the Fourth Amendment, even though virtually every American would place a much higher value on the private details revealed by the sum total of the metadata that they generate.
At the time Smith v. Maryland was decided, the courts did not anticipate this seemingly absurd result, in part because the case was decided prior to the era of cheap data storage, modern computing power, and sophisticated network analysis. "It is not possible to argue honestly that the facts of Smith are anything like the NSA’s bulk data collection," Jim Harper argued at the Cato Institute's blog. "The police had weighty evidence implicating one man. The telephone company voluntarily applied a pen register, collecting analog information about the use of one phone line by that one suspect. I can’t think of a factual situation that could be at a further extreme than NSA’s telephone calling surveillance program." *
Judge Richard Leon made a similar argument when he found that the NSA's bulk collection of telephone metadata is, in fact, a violation of the Constitution.
But since a different federal judge has just invoked Smith while reaching a contrary conclusion—that the Fourth Amendment does not prohibit bulk metadata collection—it's worth dwelling on what embracing the NSA's reading of Smith would really mean, and why doing so is an unsound approach to interpreting the Constitution, even if we forget about the present controversy and speak more generally.
To illustrate what I mean, indulge a hypothetical I dreamt up while trying to articulate to myself why I find the way Smith is being invoked so illegitimate and dangerous.
Like most Americans, I go with some regularity to the barber shop. I sit down in the chair, the barber goes to work with his scissors, and by the end of the cut my hair is strewn about the floor. As I pay at the register, the barber sweeps up my hair and dumps it into a trashcan. It subsequently goes out to the dumpster in back. By the logic of Smith, I have no reasonable expectation of privacy as regards this hair. I freely allow it to be clipped from my head and to fall to the floor, knowing full well that third parties will take possession of it en route to the dump.
For the sake of this hypothetical, let us imagine two technological advances that take place 10 years apart. In 2015, a shampoo is introduced that prevents any hair washed with it from revealing the DNA of the person to whom it belongs. Widely used in barber shops, it renders the fact that I have no reasonable expectation of privacy in the hair I leave on the barbershop floor completely unproblematic. There is no scenario in which authorities could perpetrate serious, widespread abuses using hair taken from the floors of barbershops. And anyone could easily protect the privacy of the DNA in their hair, as a 2016 Supreme Court opinion notes while upholding the police's ability to gather hair from dumpsters.
But in 2025, another unexpected innovation occurs. Using technology unimagined in any prior year, analysts can determine, given a strand of human hair, every memory possessed by the owner of the hair at the moment when it was cut. And this technological advance is kept secret. Deep inside the NSA's headquarters, its employees are taking delivery from the contents of barbershop and salon dumpsters all over America, extracting the memories of millions of Americans, and creating a database where all of that intensely private data can be queried.
(All in the name of stopping terrorism, of course.)
Suddenly, the real-world consequences of the earlier precedent are dramatically different. With the ability to extract memories from hair, authorities have warrantless access to virtually everything previously protected by the Fourth Amendment: contents of phone calls, visuals of what goes on inside people's bedrooms, etc. The guarantee of being secure against unreasonable searches is all but meaningless now that police can examine the full contents of virtually everyone's memory in a process not considered a search for Fourth Amendment purposes.
If all that transpired, judges would be forced to choose between straying from the precedent they established in a world where its implications were completely unclear, or upholding the precedent and rendering the Fourth Amendment meaningless. Which course would better fulfill the oath that they swore to "support and defend the Constitution of the United States"? For those who constantly invoke balancing tests, which course would better balance security and privacy?
Phone-call metadata is not so revealing as the contents of every memory a human has. But it can reveal a lot of information that would otherwise be protected, and there is a way in which my hypothetical is applicable to the cases presumably working their way up to the Supreme Court. NSA defenders would have the court uphold the precedent it set in Smith v. Maryland without regard for the fact that technology now permits federal authorities to glean far more from the material Americans voluntarily hand over to third parties than was true in 1975. What's being seized may be identical. But the intrusiveness of the search has changed, because the search tools have changed, as has what they're able to yield. Police could quickly determine that Michael Lee Smith called the robbery victim. The NSA can quickly determine not only who people call, but whole social networks by degree of separation (not to mention location if we broaden the discussion to other metadata).
"Perhaps Smith was a bad decision from the get-go; perhaps the Fourth Amendment should never have been interpreted so meekly with regard to the information we disclose to third parties," my colleague Rebecca Rosen writes. "But maybe, we couldn't see that until the full implications came to pass, as they now have."
Indeed, I fear that the full implications have not yet come to pass, and that future technological innovations (though not the ones in my hypothetical) may make Smith even more problematic. Thankfully, Supreme Court Justice Sonia Sotamayor has already begun to rethink this area of law. As she wrote in United States v. Jones:
... it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers. Perhaps, as JUSTICE ALITO notes, some people may find the "tradeoff" of privacy for convenience "worthwhile," or come to accept this "diminution of privacy" as "inevitable," and perhaps not. I for one doubt that people would accept without complaint the warrantless disclosure to the Government of a list of every Web site they had visited in the last week, or month, or year.
But whatever the societal expectations, they can attain constitutionally protected status only if our Fourth Amendment jurisprudence ceases to treat secrecy as a prerequisite for privacy. I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection.
As well, there is a potential majority on the court that might use what's been dubbed the Mosaic Theory, explained at length here by Orin Kerr, to decide various challenges to the NSA's mass collection of telephone metadata. Any departure from Smith and its questionable interpretation of the "reasonable expectation of privacy" test would significantly reduce the potential for absurd, dangerous results, and better protect the constitutional rights of Americans going forward.
* In fact, in Smith v. Maryland, Blackmun approvingly invoked this quote from a prior Supreme Court case to demonstrate that a pen register is less intrusive than a listening device: "Indeed, a law enforcement official could not even determine from the use of a pen register whether a communication existed. These devices do not hear sound. They disclose only the telephone numbers that have been dialed—a means of establishing communication. Neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers." NSA metadata seems useful only if there is an assumption that communication has occurred between a terrorist and the people at the numbers he dials.