Fun With GPS Tracking

About a month ago, the Eleventh Circuit delivered a fairly important ruling on GPS data, holding that a warrant was required to obtain them. The New York Times editorial is fairly accurate, though I could do without the 'trample the Fourth Amendment'. The defendant was a suspect in a numbner of bank robberies, and the investigators used a magistrate's order (rather than a regular warrant) to obtain GPS information from his cellphone provider. These records clinched the case, by placing him at the scene of the rooberies.

A couple of notes. First, the order was prospective only, as the police relied in good faith in the law as it stood, and society as a whole should not be sanctioned by freeing the perpetrator of multimple armed bank robberies on what is the proverbial  'legal technicality'.

There is also practical wisdom in that, because - at the grunt level - this case only arises because of sloppy, lazy lawyering. If you have an investigation developed enough to have identified a suspect in multiple robberies, you absolutely have enough probable cause to write an affidavit for a search warrant. Which is what you do, because - to quote the play 'Harvey' - it eliminates any objections. There's simply no downside. I don't no what genius decided they'd go with the simpler form of magisterial order, but that is something no seasoned investigator should have done. Good legal practice is to avoid unnecessary issues whenever possible.

Second, this is a good result. The term 'metadata' applies to a huge and varied amount of information. I have little patience with persons who are bothered by easy access of the authorities to core metadata, such as phone records, ISP routing and the like. It's self-evident these are disclosed to the provider, as are credit statements. It should be obvious even to the most naive that these aren't private, and never were.

But there are other typethat are far more complex, and location data is a prime example. I think most of us understand it in principle, but the extent and sophistication of it is poorly understood, at least by me. It's also not at all clear when it's on or when it's not, it can vary application by application, and sometimes it's on by default. So what the 'reasonable expectations of privacy' are here is not at all clear to me, even though the basic use of an application like MAPS obviously implies disclosure to a neutral third party. So I am inclined to think a warrant should be required. Something similar could be said about texting, and various forms of IM messaging, in which the content is inextricably intermixed with the metadata routing.

So, a good decision, and perhaps an inevitable one.

But before we let the case sink gently under the surface, let's have a little fun with it. The actual case involved a suspect and an attempt to verify his proximity to the scene of the crimes. Let's turn it around. Consider a hypothetical in which we have a number of crime scenes and no identified suspect.

Six young women have disappeared over a one year period, roughly two months apart, from different, scattered parts of a city. We have a seventh site, because a month or so ago a hiker came across a shallo grave in a wild area outside the same city, in which the body of the second girl was found. Pretty ugly crimes. So what we'd like to do is query all the relevant holders of location data in connection with the time and place where the victims were last seen.  We'll give ourselves a four hour window and a one mile radius.

This data is primarily GPS, but also credit card usage, and maybe something I am not thinking of. We'll make this mildly futuristic and say we have developed a facial recognition software to a useful degree. So we will also run all of the video that our public cameras have picked up at near locations. The public is alamred by these disappearances, so we'll make a public appeal to anyone who has cellphone or tablet video, at the given time and place, to supply it for analysis. We get dozens, maybe hundreds of these, which used to be prohibitive in terms of manpower - but now we just drop them all into the hopper with our facial recognition software, and turn on the juice. 

When we run location one, we get 35,000 -40,000 names, which is what we expected. Locations one and two? A few hundred. Location one, two and three? A couple of dozen - maybe.  Four locations? Four or five. Five? One. Six? One. Same one. Ted Bundy. 

This is not enough to convict, though it is enough to lynch, so we'd better be careful with what we say to the public. But it is certainly enough for a tail, even with a strained police force, so for starters there aren't going to be any more victims. This already is a win. But now we can really turn on the faucets with warrants. First, let's get one for GPS data for Bundy in the month or so before that body was discovered. (Coroner tells us it wasn't in the ground all that long). There is clearly probable cause for this - it's an easy call for any magistrate. Did our boy take a trip up near the grave location? Indeed, he did. Well, well, well. 

Let's do grab more GPS data then, by warrants that are now routine, and see what we shall find. Has he taken other trips, up to other remote locations? Yes, he has, and well enough defined destinations for us to send parties out to look for unmarked graves. Find a couple more of those, and I do think we probably have enlough to convince a jury, though some would disagree. In any case, the game is REALLY afoot.

However, as much as I have relished this - pretty good screenplay there, by the way, if anyone wants to write it - there are some problems. Right at the moment, unless something has changed since I left the law, there is no judicial process that actually applies to this sort of data request. Search warrants and privacy are specific to indviduals. Investigators would have to depend on the good will of the data holders, particularly because procuring some of this data is internally quite expensive. You also have to deal with totally misguided civil libertarians - misguided, because filtering data in this way is in no accusatory, and -because of the nature of iallnvestigation. It is not possible to narrow the focus to one suspect without first defining a class or category of suspects. 

BUT, though it is misguided, there is a kernel of solid rationale there. Letting the police have access on their own stick to thousands of records of this type is more than a little dubious. Still, this sort of investigative technique is useful, and not just for serial murderers - child molestation, professional burglaries, ATM heists also might be resolved. I suspect where all this ends up is the creation of some sort of administrative warrant, something akin to the process used for building inspections and the like, in which there is some sort of basic neutral review of cause by a judicial entity.

Interesting times we live in.