Right now, CSLI comes in three flavors. The first is “real-time,” where police work with a cell provider to access location data immediately after it’s created. This usually does require a warrant. The second is a “tower dump,” when authorities ask for all the phones that have communicated with a certain tower during a period of time. There’s not a lot of law about how tower dumps work, but as of September of last year cops rarely sought a warrant for them.
The third is historical CSLI, where law enforcement requests a backlog of location data created by a certain phone. This does not require a warrant, and hundreds of these requests happen per day. In 2015, AT&T alone handled more than 58,000 requests for historic CSLI. (By contrast, it received about 17,000 real-time CSLI warrants and fewer than 1,500 tower-dump requests.) Warrantless CSLI may be the most common kind of cellphone surveillance that Americans are subject to.
The just-decided Sixth Circuit case, U.S. v. Carpenter and Sanders, is a good example of how this looks in practice. Between December 2010 and March 2011, there were a string of robberies of T-Mobile and Radioshack stores in and around Detroit. The robber, not named in the suit, confessed soon after the crimes and shared his cellphone number with the FBI. The agency requested his call records, then made a second request: the call records and cell-site location information for 16 additional phone numbers.
With this data, it identified the defendants in the suit—Timothy Sanders and Timothy Carpenter—as the alleged organizers, getaway car drivers, and lookout men for the robberies.
In making this critical second request, it asked for more than just a couple of days of location data. In fact, it asked for more than 215 days of combined CSLI, almost seven months of information total. The defendants and the American Civil Liberties Union contended that all this geographical data, when taken together, constituted a warrantless search.
“When police obtain months’ worth of cellphone data comprising thousands of individual locations, like they did in this case, they should have to get a search warrant from a judge,” said Nathan Freed Wessler, the ACLU attorney who argued the case in front of the Sixth Circuit, in a statement.
The ACLU turned to two recent Supreme Court rulings for support. In the first, Riley v. California in 2014, the justices held that authorities couldn’t search a smartphone’s data without a warrant. In the second, U.S. v. Jones in 2012, they ruled that attaching a GPS tracker to a car without seeking a warrant first violated the Fourth Amendment.
The Sixth Circuit rejected the ACLU’s reasoning. Riley covered the wealth of internal data that a phone can store, including emails, notes, photos, and text messages; and not the limited kind of location data logged on corporate servers, wrote Judge Raymond Kethledge in the majority opinion. And the precise GPS tracking at issue in Jones, he said, doesn’t approach the general locational awareness permitted by CSLI.