Third party rights and the Carpenter cell-site case – Washington Post

In Carpenter v. United States, the Supreme Court will decide whether a warrant is required for the government to obtain historical cell-site records from a customers account. This post asks a question for those who think the answer should be yes: How do you deal with the Fourth Amendment rights of the cellphone providers? Im not sure what the answer should be, but I think its an important question to help understand the issues and stakes in Carpenter.

This is a complex issue, so Im going to break it down into three steps. Ill start with an overview of the third-party doctrine. Ill then turn to third-party rights under current law. Ill next consider different ways the third-party rights might work if the Supreme Court holds that a warrant is required.

I. Overview of the Third-Party Doctrine

Lower courts have held, consistently with U.S. Supreme Court precedent, that historical cell-site records are not protected under the Fourth Amendment. They have mostly based this holding on the third-party doctrine, the rule that you dont maintain Fourth Amendment rights in information that you voluntarily disclose to a third party.

As I explained in this article, the third-party doctrine was originally intended to be the subjective expectation of privacy test in Justice Harlans Katz concurrence. The idea was that you can only have privacy in what you try to hide from others: You need to manifest your subjective expectation of privacy to have Fourth Amendment rights, shielding it from observation, so that you cant have such rights in what you knowingly disclose to others. As my article explains, this rule has been around for a very long time, but it accidentally moved over time from the subjective expectation test into the objective expectation of privacy test in the 1970s and 1980s.

The third-party doctrine has had very wide application. If a criminal confesses to his friend about his crimes, the government can get the information from the friend without implicating the criminals Fourth Amendment rights. If a person commits an offense in front of an eyewitness, the government can get the information from the eyewitness without implicating the criminals Fourth Amendment rights. If a person goes to the bank and deposits a check, the government can get the information from the bank without implicating his Fourth Amendment rights. And if a person dials a number to place a phone call, the government can get the numbers dialed from the phone company without implicating his Fourth Amendment rights.

II. What About the Constitutional Rights of the Third Party?

A key implication of the third-party doctrine is that the government only has to deal with the constitutional rights of the person or business that received and now possesses the information. Upon the informations receipt, the thinking goes, the sender of the information no longer has Fourth Amendment rights in it. Only the rights of the recipient/holder of the information matter.

That raises the question of to what extent the constitutional rights of the holder of the information can limit law enforcement. The answer is: some, although not much. First, the Supreme Court has held that there are no Fourth Amendment limits to the government compelling a person to testify about what they know and what they saw. That raises Fifth Amendment issues if the person who would testify may be thought to be involved in criminal activity, but the compelled testimony is not a search or seizure under the Fourth Amendment. See United States v. Dionisio, 410 U.S. 1 (1973).

Second, if the government compels a person or company to hand over stored records as opposed to live testimony, the Fourth Amendment applies to the records but the constitutional limit is only unreasonable burdensomeness. There is no warrant or probable cause requirement. See, e.g., Hale v. Henkel, 201 U.S. 43 (1906); In re Horowitz, 482 F.2d 72 (2d Cir. 1973) (Friendly, J.). To be sure, the Fourth Amendment still applies fully to direct entry. The government ordinarily needs a warrant to break into a business and seize records just like it needs a warrant to break into a home. But its a different situation when the government is compelling assistance rather than searching directly.

These same Fourth Amendment rules apply when the government is seeking information that a business happens to hold about its customers. Whether the target of the investigation is the business or its customers doesnt matter under the Fourth Amendment. This means that if the government is seeking a companys assistance to disclose records about the businesss customers, the information is protected under the Fourth Amendment in the abstract because the business has its own Fourth Amendment rights. At the same time, the third-party business generally can be required to keep and disclose the records under a fairly low burden. See, e.g., California Bankers Association v. Shultz, 416 U.S. 21 (1974); Couch v. United States, 409 U.S. 322 (1973); Donaldson v. United States, 400 U. S. 517 (1971). And because the information or records ordinarily could not incriminate the third party in criminal activity, the third party business cannot assert a Fifth Amendment privilege against production. See Fisher v. United States, 425 U.S. 391 (1976).

The idea that a business has only modest Fourth Amendment rights to fight compelled disclosure of customer records isnt new. It has been around a long time. For example, in First National Bank v. United States, 267 U.S. 576 (1925), the IRS wanted to see if a couple had underreported their income on their federal income tax forms. The IRS issued a summons to the couples bank requiring the bank to produce their books showing the couples banking account records. The idea was that the bank statements would reveal whether the couple had falsely reported their income. The bank refused to comply under the Fourth Amendment on the ground that producing the records was an unreasonable search or seizure and that the bank wanted to keep its customers account records private.

The district court rejected the banks claim. This is not a question of a search and seizure of a partys books and papers, the court wrote, but of whether a witness who has information as to a partys dealings may be required to testify to those facts, and produce book entries as to such entries in connection with and supporting such testimony. It would be monstrous, the court rather dramatically added, for the government not to be able to determine the proper taxes that a person owed simply because the bank desires to protect the dealings of its customers from unauthorized investigation. The Supreme Court then affirmed the district court in a one-sentence per curiam opinion upon the authority of the courts precedents about subpoenas for business records (including Hale v. Henkel, cited above).

III. Applying the Traditional Approach to Historical Cell-Site Records

Applying this traditional body of law to historical cell-site records is pretty straightforward, I think. The cellphone company generates and stores business records of what cell towers were used to connect a customers calls. Those records are like the banks records in First National Bank. The cellphone provider is ordered to be a witness who has information as to a partys dealings [and] may be required to testify to those facts, and produce book entries as to such entries in connection with and supporting such testimony.

Granted, Congress requires an intermediate facts court order under the Stored Communications Act for the government to compel those records. A mere subpoena, which would be sufficient under the Fourth Amendment, isnt enough under the statute. But if the lesser process of a subpoena is sufficient to satisfy the rights of the company, presumably the greater process of an intermediate facts court order is as well (although that hasnt been challenged), And under the third-party doctrine, access to the account records wouldnt implicate any Fourth Amendment rights of the user.

If youll pardon a brief digression, its not even clear you need the third-party doctrine to say that the records dont implicate the users Fourth Amendment rights. The third-party doctrine is traditionally about the disclosure of private information that a suspect has revealed. The idea is that the suspect has private information, chose to reveal that information (often in confidence) to someone, and then the government sought that private information from that person. The cell-site business records in Carpenter are arguably one step removed from that. They are business records of how a private company decided to direct calls to and from the user. The records are about what a private company did for a user, not necessarily what a user chose to disclose in confidence to the company.

But at the very least, the third-party doctrine seems to fit the Carpenter case under traditional caselaw principles. So the old answer would be no Fourth Amendment rights for the customer, although statutory rights provided by Congress, and only modest Fourth Amendment rights for the cellphone provider.

IV. If the Third-Party Doctrine is Rejected, How Should Courts Deal With Third-Party Rights?

Thats the old law, at least. Now lets consider how the Fourth Amendment would work if the Supreme Court rejects that traditional approach. Lets assume the Supreme Court agrees with the defendant on both issues in Carpenter: First it holds that users have Fourth Amendment rights in cell-site records, and second it holds that the records are protected by a warrant protection.

Now we get to my question: Assuming the Supreme Court makes these two holdings, how would this work with respect to the providers rights? The government does not seek cell-site records by breaking into the providers business and rummaging around its offices and computers. That would ordinarily require a warrant even under the traditional law of the third-party doctrine. The records are already protected under the Fourth Amendment as held by the company, after all, and ordinarily the government would need a warrant to break into the company headquarters and seize them because of the companys Fourth Amendment rights.

The tricky problem, I think, is what to do with the providers rights once the user also has rights in the records. Assume, for now, that the company does not want to comply with the governments legal process. If the records were about the provider, a subpoena would be enough for the government to force the company to disclose them.

Heres what Im stuck on: How do you reconcile the conflict between that rule and a warrant requirement if the Fourth Amendment rights belong to the user? Is the idea that a company served with a subpoena for business records has to figure out if the subpoena implicates only its own Fourth Amendment rights (in which case the subpoena complies with the Fourth Amendment so long as it is not overbroad) or if it also implicates a users Fourth Amendment rights (in which case the subpoena is insufficient and a warrant is required?). If the government issues a subpoena for business records and it turns out that a customer also had rights in the data, would we say that compelled compliance with the subpoena violated the rights of the user but not the company?

Alternatively, if it doesnt make sense for every subpoena and sub-warrant court order to require a standing analysis before knowing if compliance is legal, which rule do you apply to both situations if a single rule has to be chosen? Do you say that both situations require a warrant, such that all subpoenas issued to businesses now require probable cause and warrant particularity (effectively eliminating the use of business record subpoenas for investigations)? Or do you say that neither situation requires a warrant, such that the user has Fourth Amendment rights in cell-site records but that a valid subpoena is enough to overcome the Fourth Amendment rights just as it it would for ordinary business records?

Next assume that the cellphone company wants to cooperate. If both the user and the company have Fourth Amendment rights in the records, then I imagine the common authority doctrine would apply. Under the common authority doctrine, if there is mutual use of the property by persons generally having joint access or control for most purposes, they both can consent to a search. See United States v. Matlock, 415 U.S. 164 (1974). Cellphone customers may not have joint access and control over cell site records: They dont know what the records say and have no ordinary means of accessing them. But if they nonetheless have Fourth Amendment rights in the records, I would think that at least the company has common authority over the records allowing them to legally consent to law enforcement access to the records.

If thats right, though, how does it work if the phone company is willing to help the government? Imagine Carpenter holds that users have Fourth Amendment rights in cell-site records, and that a warrant is ordinarily required. Can a provider tell the government that as long as the government has a 2703(d) court order, as required by the statute, that it will voluntarily consent to hand over the records under the common authority doctrine? If so, whether there is really a warrant requirement would depend on what the company wants to do: Because both the user and the company have common authority over the companys business record, the company could consent and eliminate the right.

You could try to avoid this by saying that the cellphone providers lack common authority over their own business records. But that seems like a hard result to justify. The companies created and used the records and keep them. It seems hard to say that they lack access to or control over the records that they created and keep for their own use.

Granted, caselaw would suggest that companies lack common authority to consent to a government search of the contents of communications, such as emails. In physical space, the landlord of an apartment or the hotel employee at the hotel lacks common authority to consent. See Chapman v. United States, 365 U.S. 610 (1961) (landlord); Stoner v. California, 376 U.S. 483 (1964) (hotel employee). By analogy, I would think that an email provider couldnt ordinarily consent to a search of the contents of a users emails, at least barring some unusual terms of service. But with cell-site records, I would think that the phone companies have at least common authority (if not exclusive authority) over the records of how their network connected calls.

V. Let Me Know Your Thoughts

For the seven readers that have made it this far, let me know your thoughts! There may be good answers to these questions. But it seems like largely uncharted territory, and Im not sure yet what those good answers are.

See the original post:
Third party rights and the Carpenter cell-site case - Washington Post