Originally Published in The Washington Post
Cat Zakrzewski and Tonya Riley - December 2, 2020
“It’s critical we uncover how federal agencies are accessing bulk databases of Americans’ location data and why,” Nathan Freed Wessler, senior staff attorney with the ACLU's Speech, Privacy, and Technology Project, said in a statement. “There can be no accountability without transparency.”
Senate Democrats, such as privacy advocate Sen. Ron Wyden (D-Ore.), had written a letter to DHS asking for more information on how such data was being used. On Wednesday morning, they disclosed that the department's inspector general would take up the matter.
“If federal agencies are tracking American citizens without warrants, the public deserves answers and accountability,” Wyden said in a statement. “I won’t accept anything less than a thorough and swift inspector general investigation that sheds light on CBP’s phone location data surveillance program.”
The lawsuit highlights how the explosion of private-sector data and location-tracking services can be leveraged by the government.
Government agencies typically need a warrant to access customer data directly from tech companies. But some have found a workaround by looking to buy similar information from third-party companies, a practice the ACLU argues deserves greater scrutiny and may in some cases be illegal.
Debates over how much access law enforcement should have to citizens' private information are as old as the Constitution itself. But they've taken on greater urgency in the digital era, particularly after Edward Snowden's revelations about the government's systematic surveillance of American citizens.
The ACLU argues the privacy battle goes beyond understanding how agencies use location data to enforce immigration laws. The group also seeks to “assess whether the government’s purchase of this sensitive data complies with constitutional and legal limitations and is subject to appropriate oversight and control.”
The ACLU has been trying to obtain more records about how government agencies have been using this data for more than nine months. But the group says those agencies have not shared any responsive documents to the organization’s Freedom of Information Act requests.
“We’re asking the agencies to turn over all records related to their purchase and use of cellphone location data, including contracts, policies and procedures for use, communications with companies, legal analyses, and more,” the nonprofit explained in a blog post.
Little is known about how DHS, CBP and ICE are using location data.
The data is collected from apps running on people’s phones. Often apps — including for games, weather and e-commerce — sell the data they’re collecting to data brokers, which then sell it to government agencies, according to the ACLU's lawsuit.
The Wall Street Journal’s Byron Tau and Michelle Hackman reported in February that ICE had used such data to identify immigrants who were later arrested, and CBP had employed it to look for cellphone data in specific areas, such as zones of the desert that border Mexico.
DHS did not immediately respond to a request for comment about the ACLU lawsuit. The agency and its counterparts acknowledged to the Journal in February that it had bought location data, but it declined to discuss how it was being used in law enforcement. CBP told the Journal it had privacy measures in place to ensure that it only accesses a small amount of location data, and that the data it uses is anonymized.
“While CBP is being provided access to location information, it is important to note that such information doesn’t include cellular phone tower data, is not ingested in bulk and doesn’t include the individual user’s identity, “a CBP spokesman told the Journal. “Tower data from cellphone companies, which can locate a specific phone, has been singled out by the Supreme Court for extra protection.”
The ACLU is questioning whether the government's purchase of location data is legal.
The group argues the agencies may be violating the Fourth Amendment in obtaining such data through the private sector and circumventing a traditional warrant process. The organization argues the agencies may be violating a precedent set in the Supreme Court's 2018 decision in Carpenter v. United States, which determined that law enforcement agencies can't request location information from a cellphone company without obtaining a search warrant.
“If law enforcement agencies can buy their way around the Fourth Amendment’s warrant requirement, the landmark protection announced by the Supreme Court in Carpenter will be in peril,” the ACLU wrote in a statement.
Senators began scrutinizing the agencies' use of location data earlier this year. Several Senate Democrats led by Wyden earlier this year wrote a letter to Joseph V. Cuffari, the DHS inspector general, looking to gain greater insight into any legal analysis conducted to ensure the CBP's use of location databases complied with the law. Senators said CBP asserted such analysis was privileged, and they disagree.
“CBP is not above the law and it should not be able to buy its way around the Fourth Amendment,” the senators wrote.