Constitutional boundaries of digital footprints: The controversy over the geo-fencing order

In the past, the police's logic in handling cases was to find clues, identify suspects, and apply for search warrants. Now it's the other way around. First draw a circle, pull out the mobile phone data of everyone in the circle, and then see who looks like the suspect. This is the geofence warrant. The U.S. Supreme Court recently ruled by a 6-3 vote that such large-scale sweeps of location data must be subject to the Fourth Amendment and require "reasonable grounds." Many people regard this as a victory for privacy, but I think the real problem is not privacy, but the law enforcement system's reliance on "reverse investigation" paths. When you have a digital net in your hand that can connect everyone, you no longer need to find that particular fish.

To understand the weight of this ruling, we must first remove the enforcement mechanism of the geofence order. Take the Okello Chatrie armed bank robbery case for example. The police found no effective clues at the scene and directly asked Google for the location history of all mobile phones around the scene. Google usually follows a three-step process in cooperating with such requests: first, it provides an initial list of all anonymous device IDs; second, the police expands the time window and geographical range to ask Google to narrow the list; third, the police picks out several tracks and looks at suspicious IDs and asks Google to hand over their real names and email addresses. Chatrie was accurately targeted because her mobile phone reported its location to Google every few minutes and was eventually sentenced to 12 years. It's not complicated, but it's extremely ridiculous. In order to catch a robber, the police searched the digital pockets of hundreds of innocent passers-by at the scene of the crime essentially without a warrant. According to Google's 2020 Transparency Report, they received more than 11000 geofence requests, accounting for a quarter of all search warrants. Elena Kagan of the Supreme Court made it clear in her majority opinion: There is no reason to deprive constitutional protection just because data is stored on a third-party server.

Lao Lin is a data researcher for a criminal investigation detachment in a city and has been working for 20 years. In the past, when taking apprentices, they had to go to the scene to investigate, look at dead spots in surveillance, find witnesses, and piece together portraits of suspects in their minds. Now that there is a burglary in the area, the first reaction of the newly assigned young policeman is not to go to the scene, but to go back to the office to open the system, retrieve the signaling data of the base station of the community where the crime occurred over the past 24 hours, and run a collision script. Looking at the dense MAC addresses and IMSI codes on the screen, the young man thought that this was "strong police with technology." Lao Lin looked at them while smoking a cigarette and understood that these people's "investigative instincts" were shrinking. When the system can spit out 50 suspected numbers with one click, no one wants to spend three days interviewing the security guard who may have seen a suspicious vehicle. The most terrible side effect of a tool is not that it occasionally makes mistakes, but that it makes users lose the ability to not use it. The geo-fence order is this ultimate "lazy tool" that transforms police officers from hunters looking for clues to data analysts running SQL statements.

Compare this with the credit card risk control system, and the account will be clear. Suppose a bank directly freezes all credit cards with transactions that occurred in the mall from 2 p.m. to 4 p.m. in order to catch a person who swiped credit cards in a certain mall. Then send a text message and ask the cardholder to call himself to unfreeze the transaction, while the bank reviews these transaction records one by one in the background. This is called "large-scale accidental killing" in the field of risk control. It is a bad strategy that will be scolded by users and fined by supervision. Why is this logic of "freezing all quantities first, then investigating one by one" so popular in the field of law enforcement? Because law enforcers do not need to bear the commercial costs of "manslaughter". Innocent passers-by who are searched will not give the police bad reviews, nor will they cause the police department's revenue to decline. There is no commercial feedback loop to punish inefficiency and abuse, and the boundaries of power can only be covered by the hard constraints of the Constitution.

The opposing side will definitely jump. The reasons given by law enforcement agencies and some conservative judges sound strong: First, when you walk in public places, there is no "reasonable expectation of privacy", and others can see you when you walk on the street; second, this is a powerful weapon for arresting armed robbers and kidnappers, and restricting geofence orders will cause the detection rate to drop sharply and indulge bad guys.

The first reason is sheer nonsense in the digital age. The 1967 Katz case established the "reasonable expectations of privacy" test, and the 2018 Carpenter case was a direct slap in the face: your single action in public places has no privacy, but your "location history" for several months has pieced together a complete picture of your life, which definitely has privacy expectations. As for the second reason, I make a bet that the geofence restriction order will not lead to a decrease in the overall detection rate at all. On the contrary, it will force police to reinvest resources into traditional, solid, clue-based investigations. Criminals caught in a lazy way cannot make up for the more clues they miss because of laziness. When it becomes difficult to "cast a net to catch fish", the police will learn how to "fish" again.

Go beyond the law and look at the business accounts of technology companies. Google is actually ungrateful on both sides in this kind of case. Cooperate with the police, you will be scolded by privacy advocates and bear huge legal review costs; if you don't cooperate, you will be issued a subpoena by the government and even face contempt charges. So it's interesting to see Google's subsequent product adjustments. They changed the default storage of Location History from the cloud to the local device, which actually physically reduced the "toxic assets" in their hands. Apple's strategy is even more decisive, from iOS 14's App Tracking Transparency to later making iMessage and iCloud backup end-to-end encryption (Advanced Data Protection). Apple's logic is: I can't solve it physically, and it's useless if you force me, judge. This is not only a privacy selling point at the product level, but also a commercial "compliance hedge". Turning data into a hot potato for whoever touches and who provokes trouble is the best solution for technology giants to deal with bottom-line data requests.

The controversy over the geo-fencing order is ostensibly a patch made by the Fourth Amendment in the digital age, but is essentially a human struggle against the alienation brought about by "omniscient tools." We invented tools that could record everything, and then tried to restrict it with laws written on parchment hundreds of years ago. The Supreme Court's ruling hit the brakes this time, but the car continued to slide forward. When every atom in the physical world is digitized by sensors, and when the judgment of "reasonable basis" changes from the common sense of human judges to a few weight parameters in the filtering algorithm, the question we really want to ask is: In front of the algorithm black box, is the Constitution protecting our privacy, or is it protecting us from being reduced to rows of logs that can be queried at will?