CBP, ICE Hoovering Up Cell Location Data From Third Party Vendors To Track Down Immigrants

Privacy

from the 'legal-gray-areas'-is-where-we-do-our-best-work dept

Supreme Court precedent says the government needs a warrant if it wants to get cell-site location info. This ruling altered the contours of the Third Party Doctrine, making it clear not every third-party record exists outside the Fourth Amendment’s protections.

But that only applies to location info gathered from cell service providers utilizing the data they collect from cell tower connections. When the government wants to track the movement of individuals, it can do it, but it needs a warrant. When it just wants a bunch of location data on everyone in an area, somehow the warrant requirement disappears.

That’s what CBP and ICE are doing. According to a report by the Wall Street Journal [paywall], the agencies are buying location info in bulk from third-party vendors. No warrant required.

The Trump administration has been using commercial data that tracks millions of smartphone users’ locations to help enforce its policies on immigration and deportation, according to a report Friday from the Wall Street Journal.

The database, owned by a company called Venntel Inc., collects information from run-of-the-mill games, weather and shopping smartphone apps where users have agreed to share their location, according to the report.

This isn’t cell-site location info, technically. But a lot of this location data wouldn’t exist without cell towers. The CBP believes this is all very legal, as it does not target any one person and, in a rather stupid assertion, claims the data is “pseudonymized.” This means the location data isn’t linked to identifying info about the cell phone’s owner. But that word means even less than the usual “anonymized.” The application of analytic tools can strip this anonymization away, even without additional data pulled from other sources.

If the data were truly anonymized, it would be worthless: just a bunch of data points unrelated to anything. But it obviously isn’t anonymized — or at least isn’t that way for long after the agencies obtain it — or the government wouldn’t be saying things like this:

Sources told the Journal that Immigrations and Customs Enforcement (ICE) and Customs and Border Protection (CBP), two divisions under the Department of Homeland Security (DHS), have used the location data to help them identify and locate those who may have entered the country unlawfully, whom they later arrested.

Both agencies have been using this data since 2017, according to contract info obtained by the Wall Street Journal. For now, it’s still legal to obtain this data from third parties without a warrant. It’s unlikely this data will see a successful challenge any time soon, not if it’s coming from third parties that have been given explicit permission to collect location data.

But that doesn’t mean current protections for cell-site location info won’t eventually expand to cover third parties like Venntel. Voluntarily sharing location info with a company isn’t the same thing as voluntarily sharing data with the government, no matter how much the government argues there’s no expectation of privacy in records freely given to third parties. Many people feel more comfortable sharing data with companies, since the end result tends to be things like targeted ads, rather than targeted investigations.

Oddly, CBP claims the data is not “ingested in bulk,” which seems to run counter to how this data is purchased. If it’s truly anonymized, the CBP has no choice but to obtain it in bulk and work from there to determine who it’s targeting for removal. Perhaps the CBP’s definition of “bulk” is different than the common definition of “bulk.” Maybe the agency believes that throwing up a couple of geofences prevents this from being a “bulk” collection. If so, the government is wrong. Anything that provides massive amounts of data from multiple sources is a, by definition, a “bulk collection.”

This is working for the government right now. But sooner or later, this haystack-building method will likely find itself on the wrong side of the Constitution, especially when courts are informed of just how meaningless the word “anonymized” is in the context of bulk location data.

Filed Under: 3rd party doctrine, cbp, cell site location info, commercial purchases, csli, dhs, ice, location tracking, privacy, warrants