After Snowden: Regulating Technology-Aided Surveillance in the Digital Age

AFTER SNOWDEN: REGULATING TECHNOLOGY-AIDED SURVEILLANCE IN THE DIGITAL AGE DAVID D. COLE * Imagine a state that compels its citizens to inform it at all times of where they are, who they are with, what they are doing, who they are talking to, how they spend their time and money, and even what they are interested in. None of us would want to live there. Human rights groups would condemn the state for denying the most basic elements of human dignity and freedom. Student groups would call for boycotts to show solidarity. We would pity the offending state’s citizens for their inability to enjoy the rights and privileges we know to be essential to a liberal democracy. The reality, of course, is that this is our state—with one minor wrinkle. The United States does not directly compel us to share all of the above intimate information with it. Instead, it relies on private sector companies to collect it all, and then it takes it from them at will. 1 We “consent” to share all of this private information with the companies that connect us to the intensely hyperlinked world in which we now live through our smart phones, tablets, and personal computers. 2 Our cell phones constantly apprise the phone company of where we are, as well as with whom we are talking or texting. 3 When we send emails, we share the addressing information, subject line, and content with the internet service provider. 4 When we search the web or read something online, we reveal our interests Copyright © 2016, David D. Cole. * Hon. George J. Mitchell Professor in Law and Public Policy, Georgetown Law. I delivered a version of this essay at the John E. Sullivan Lecture at Capital University Law School in 2014. Parts of this essay are also developed and adapted from David Cole, Is Privacy Obsolete?, NATION (Apr. 6, 2015), http://www.thenation.com/article/privacy-20-surveillance-digital-age, and David Cole, Must Counterterrorism Cancel Democracy?, N.Y. REV. BOOKS (Jan. 8, 2015), http://www.nybooks.com/articles/2015/01/08/must-counterterrorism-cancel-democracy. 1 See, e.g., Glenn Greenwald, NSA Collecting Phone Records of Millions of Verizon Customers Daily, GUARDIAN (June 6, 2013, 6:05 AM), http://www.theguardian.com/world/ 2013/jun/06/nsa-phone-records-verizon-court-order. 2 See Smith v. Maryland, 442 U.S. 735, 743–44 (1979). 3 See Barton Gellman & Ashkan Soltani, NSA Tracking Cellphone Locations Worldwide, Snowden Documents Show, WASH. POST (Dec. 4, 2013), https://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html. 4 See, e.g., What Data Does Google Collect?, GOOGLE, https://privacy.google.com/data-we-collect.html (last visited Mar. 27, 2016). 678 CAPITAL UNIVERSITY LAW REVIEW [44:677 to the company that runs the search engine. 5 When we purchase anything with a credit card, we pass on that information to the credit card company. 6 In short, we share virtually everything about our lives—much of it intensely personal—with some private company. It is recorded in an easily collected, stored, and analyzed digital form. We do so “consensually,” at least in theory, because we could choose to live without using the forms of communication that dominate modern existence. But to do so would require cutting oneself off from most of the world as well. That is a high price for privacy. We do not affirmatively consent to share this information with the government. But a rule announced back in the analog age by the Supreme Court of the United States holds that what we share with third parties is no longer private, at least when the government obtains information from the third party. 7 Thus, if the Federal Bureau of Investigation (FBI) wants to find out who we have been calling and where we have been, it can approach the phone company and demand our phone data and location records. If it wants to know what websites we have been visiting, it can demand those records from our internet service provider. If it wants to know what we have been thinking about, it can obtain our search history from Google. Under the Court’s third-party disclosure rule, we have no privacy interest in any of this information. As a constitutional matter, the government can obtain it without any basis for suspecting us of wrongdoing and without a judicial warrant. 8 The third party disclosure rule is just one way in which privacy protections are threatened in the digital age. The border search exception 9 5 Id. 6 See Charles Duhigg, What Does Your Credit Card Company Know About You?, N.Y. TIMES MAG. (May 12, 2009), http://www.nytimes.com/2009/05/17/magazine/17credit-t.html. 7 See United States v. Miller, 425 U.S. 435, 443 (1976). This Court held repeatedly that the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed. Id. 8 See id. As discussed below, some courts have questioned the applicability of the third-party disclosure rule in the digital era, in particular to cell phone location data. See infra note 10 ; United States v. Graham, 796 F.3d 332 (4th Cir. 2015), reh’g en banc granted, 624 Fed. App’x 75 (4th Cir. 2015). 9 See United States v. Ramsey, 431 U.S. 606, 616 (1977). (continued) 2016] TECHNOLOGY-AIDED SURVEILLANCE 679 has long held that the government may search an individual and her possessions when she is crossing the border, without a warrant, probable cause, or any individualized suspicion. 10 But most of us routinely carry some form of personal computer—a laptop, tablet, or smart phone—with us when we travel, including internationally. And, as the Court observed in Riley v. California, 11 those computers generally contain more personal information than could be gleaned from an exhaustive search of one’s home. 12 They record with precision and unerring accuracy who you have been communicating with, what you have been reading, what information you have searched for, and where you have been. 13 Should the state be permitted to search computers for such information, without any basis for suspicion, simply because one is crossing a border? If the U.S. government had its way, every arrestee who happened to be carrying a cellphone would also have surrendered all the information on his phone to the police. The government maintained that the search incident to lawful arrest exception—which provides that the police may, without any further suspicion or warrant, search the person of an arrestee and any containers in his immediate control—authorizes police to search arrestees’ cell phones and smart phones. 14 The Court, however, unanimously rejected that proposition, holding that because of the quantity That searches made at the border, pursuant to the longstanding right of the sovereign to protect itself by stopping and examining persons and property crossing into this country, are reasonable simply by virtue of the fact that they occur at the border, should, by now, require no extended demonstration. Id. 10 See Ramsey, 431 U.S. at 616; but see United States v. Cotterman, 709 F.3d 952, 957 (9th Cir. 2013) (declining to apply the extended border search exception to forensic search of laptop computer). 11 134 S. Ct. 2473 (2014). 12 See id. at 2491. [A] cell phone search would typically expose to the government far more than the most exhaustive search of a house: A phone not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form—unless the phone is. Id. 13 See id. at 2490 (observing that “it is no exaggeration to say that many of the more than 90% of American adults who own a cell phone keep on their person a digital record of nearly every aspect of their lives”). 14 See id. at 2491. 680 CAPITAL UNIVERSITY LAW REVIEW [44:677 and personal character of the information contained in cellphones, the police must obtain a warrant to search a cellphone of an arrestee. 15 As Jennifer Daskal has powerfully shown, computer data can travel across borders without our awareness, is often difficult to associate with particular individuals while en route, and can be stored virtually anywhere in the world. 16 These features have the potential to compromise privacy protections for such data in significant ways. 17 If the Fourth Amendment is deemed not to protect against searches directed at foreign nationals living abroad—as a broad reading of the Court’s decision in United States v. Verdugo-Urquidez 18 might suggest—then many of our communications are, as a practical matter, vulnerable to searches without constitutional limitation of any kind. 19 In that case, the Court declined to extend the Fourth Amendment’s warrant requirement to U.S. officials’ search of a Mexican national’s home in Mexico. 20 Relying on that precedent, the U.S. government maintains that as long as the National Security Agency (NSA) targets a foreign national living abroad, it need not satisfy Fourth Amendment standards, even if it “incidentally” collects communications with U.S. citizens and residents by doing so. 21 As a result of the digital revolution, the face of privacy has changed, and will continue to change, dramatically. We are in danger of losing much of the privacy we once had, which has immense consequences not only for our personal lives but also for the character of our country. The aim of this essay is to describe the danger, respond to some of the most common arguments that we need not worry about the problem, and point to signs that all three branches of the federal government have begun to recognize that the digital age poses new challenges that require new rules to ensure the protection of privacy. The significance of digital...