Staying Logged In All The Time? Diversify for Privacy

MA high court: high court rules warrant needed for cell phone search

In an interesting cell phone data privacy case, the Supreme Judicial Court of Massachusetts held that law enforcement must obtain a warrant before using a suspect's cell phone data to track his movements via GPS. SJC held a warrantless search violated Article 14 of the Massachusetts Constitution, which bars unreasonable searches and seizures.

The plaintiff in the case, Shabazz Augustine, was a suspect in a 2004 homicide of his girlfriend. Police obtained his cell phone records from Sprint that showed what towers were used as he traveled in Boston. Police relied on a federal law that only requires “information to be relevant to an investigation” in order to get the data, as opposed to requesting a search warrant (and having a judge find probable cause regarding the target’s involvement in the case).

Practically speaking, the case is somewhat dated: police in most criminal cases now request warrants for such data anyway.

Google: we will invade your privacy

In a blunt admission in a brief filed recently in federal court, lawyers for Google said people have no expectation of privacy when they send messages to a Gmail account.

Google’s brief said: “Just as a sender of a letter to a business colleague cannot be surprised that the recipient’s assistant opens the letter, people who use web-based email today cannot be surprised if their emails are processed by the recipient’s [email provider] in the course of delivery. Indeed, ‘a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’

A highly redacted version of the complaint was filed publicly.

Facebook leaked data all over internet--including non-users

Security researchers who revealed Facebook's shadow profiles vulnerability are claiming that Facebook leaked massive amounts of data, including private phone numbers and other personal data--despite what Facebook told its users.

Facebook had announced the fix of a bug that inadvertently exposed the private information of over six million Facebook users. In addition, Facebook apparently is collected non-user phone numbers and email addresses and then matched the data to people. Here is the technical explanation of how data gets merged over several sets of databases, and unique links are discovered.

Knowing the information industry, I expect that this data will be for sale very shortly.

No right of privacy in IP case

Judge Young in Liberty Media Holdings, LLC v. Swarm Sharing Hash File & Does 1 through 38, held "the constitutional presumption of openness of judicial proceedings" trumps the privacy claims of defendants, who swarmed to illegally download and distribute gay pornography. The film (with the winsome title “Corbin Fisher Amateur College Men Down on the Farm&rdquoWinking was downloaded illegally; the IP addresses of the downloaders was used to track and identify them. Young did leave an opening for defendants: “Nevertheless, should individual defendants be concerned about being publicly 'outed' as discovery proceeds, the Court will entertain those arguments on an individual basis.” 

Yahoo joins Google: We want to stalk Americans for 18 months

Yahoo has announced that it will join Google in stalking Americans electronically in some form for 18 months (Yahoo had in 2008 reduced the amount of time it retained users’ Internet search data to a mere 90 days). Yahoo plans to extend the retention period this summer. Retained search data will include user’s IP addresses and cookies, which means data can be linked to individual devices or people. After 18 months, Yahoo will retain most of the data, but anonymize it so it cannot be linked to individuals.

Google has a slight variation in their policy which is being misreported in wake of this story: From Google: “We believe anonymizing IP addresses after 9 months and cookies in our search engine logs after 18 months strikes the right balance.” Stalkers do have some sense of decorum after all.

Case on scope of DPPA appealed to Supreme Ct.

A Texas case, Taylor v. Acxiom et al. is under appeal to the Supreme Court to clarify opposing rulings in federal courts about the scope of the Driver’s Privacy Protection Act (18 U.S.C., Chapter 123, §§ 2721-2725. While the DPPA has specific provisions for law enforcement and private investigators to access the data, the state of Texas has allowed mail order businesses to purchase driving records. The plaintiffs in Taylor argue that neither type of defendant has access to the records.

Lumping the two types together seems a weak position given the specific exceptions of the statute. The crux of the dispute lies in the Taylor court’s determination that an authorized recipient of DMV records is not required to show that it is also an authorized user of the data. “Instead, an authorized recipient is authorized to resell to individuals for one or more of the specific purposes under section 2721 (b),” Judge William L. Garwood wrote on behalf of the 5th Circuit. The interpretation allows for an “authorized recipient to mean something different than one who has a permissible actual use.”

A case going the other direction was in Missouri. In 2008, Judge Nanette K. Laughrey found in Roberts, et al.  v. The Source for Public Data, et al., that defendants did not qualify as “authorized recipients” of DMV records under the DPPA.

Old news becomes new again depending on who won

Interesting note showing the national media misreporting the ongoing controversey in GPS privacy cases: "Media discovers August 27th that Pineda-Moreno was decided January 11th"

Supreme Ct. ready to settle GPS surveillance - privacy issue?

The 4th Amendment right to be free from unreasonable searches by the government continues to clash with technology as judges seem to be deciding cases, not on any objective standard, but more on former Justice Potter Stewart's hopelessly subjective "But I know it when I see it" standard.

Latest case is United States v. Maynard, where a Washington DC court struck down a man's conviction in a drug case on the grounds the police unlawfully tracked his movement with a GPS device for 24 hours per day--a device installed without a warrant. Thus the court contradicted decisions GPS-related cases by appellate panels in Chicago, St. Louis and San Francisco.

Courts have held that the Fourth Amendment does not cover surveillance of a suspect because people have no expectation of privacy for actions exposed to public view. But the DC appeals court held that people expect their overall movements to be private because most people see only isolated moments of someone's life. Contrast that to a police department’s GPS technology that inexpensively tracks someone’s comings and goings for weeks at a time: "A person who knows all of another’s travels can deduce whether he is a weekly churchgoer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individual or political groups — and not just one such fact about a person, but all such facts.”

In other privacy cases, courts have recognized that aggregating information can lead to practices that, without technological improvements, are not a burden on privacy (for example, state databases that aggregate criminal records may have limited access, even while each court docket is considered public record).

Massachusetts Wiretap Act Governs Out of State Telephone Recording Massachusetts Wiretap Act Governs Out of State Telephone Recording

A Massachusetts Superior Court judge ruled in In Heffernan v. Hashampour that the state Wiretap Act applies when a party outside of Massachusetts secretly records a telephone call to a party in this state. Thus Massachusetts continues to provide its citizens with protection (some say over-protection) from secretive audio recordings. The flip side of this protection can be seen in the case of Simon Glik, who was arrested for video recording police officers making an arrest near Boston Common in 2007. The criminal charges were dropped and Glik has filed a civil rights lawsuit against the City of Boston and three Boston police officers, arguing that public space is not covered by the wiretap law (ie. there is no expectation of privacy in a public place).

Privacy is dead and no one cares

Recently, we tracked down a number of witnesses using the usual armada of investigative databases. However, some witnesses had moved recently and did not appear to have current addresses in the data. No problem: many witnesses between the ages of 21 and 30 had conveniently plastered their entire personal life on Facebook, Twitter, Bebo, etc. making follow up relatively easy. One witness when called on her "private" cell phone expressed dismay at the intrusion. Later, she realized that she had provided the cell phone to a numer of retailers who, to her surprise, resold her "private" cell number database firms.

The modern American: willing to give private contact information to grocery clerks in exchange for "special offers" on mustard.

Privacy, surveillance & civil litigation: a Massachusetts guide for private investigators

The Massachusetts Bar Association hosts a good summary of privacy laws as they apply to video surveillance in Massachusetts civil litigation, including insurance cases. One of the leading cases in Mass. is DiGirolamo v. D.P. Anderson & Associates, Inc., The court wrote that investigators may generally observe, or photograph a person in public places. A gray area arises when a person enters the privacy of their own home. The court looked at 4 scenarios as to whether a private investigator violates a person's statutory right to privacy:

~ the investigator looks through a window into an apartment with the naked eye;

~ the investigator looks with the naked eye when a person walks out onto a balcony;

~ the investigator photographs, or looks at the person on a balcony with enhanced vision;

~ the investigator photographs or looks at a person inside the home with enhanced vision.
The Mass. court concluded that only the fourth scenario would constitute an unreasonable and substantial interference with the plaintiff’s right to privacy.

The court adopted the United States Supreme Court’s Fourth Amendment analysis from Oliver v. United States. It also quoted a Second Circuit Court of Appeals’ case United States v. Taborda: “Observation of objects and activities inside a person’s home by unenhanced vision from a location where the observer may properly be does not impair a legitimate expectation of privacy. However, any enhanced viewing of the interior of a home does impair a legitimate expectation of privacy.”

Written by lawyers Joseph M. Desmond & David Viens, this article has some good information on Massachusetts state laws applicable to video surveillance, audio recordings, pretext interviews and pretrial discovery.