Surveillance & Privacy

Brett Kavanaugh's Failure to Acknowledge the Changes in Communications Technology: The Implications for Privacy

Susan Landau
Friday, August 3, 2018, 2:00 PM

Facebook became available to the general public in 2006; Apple's smartphone was announced the following year. In little over a decade, the devices, and the communications they engender, have become ubiquitous. Fully 95 percent of Americans own cell phones; 77 percent, smartphones. We carry mobile devices everywhere, using them to carry out a multitude of tasks.

Published by The Lawfare Institute
in Cooperation With
Brookings

Facebook became available to the general public in 2006; Apple's smartphone was announced the following year. In little over a decade, the devices, and the communications they engender, have become ubiquitous. Fully 95 percent of Americans own cell phones; 77 percent, smartphones. We carry mobile devices everywhere, using them to carry out a multitude of tasks. We communicate from the grocery store, while walking down the street, at a restaurant, sitting at a table in a restaurant, while in the kitchen, the bedroom, and even the bathroom. In the process of using mobile phones, we broadcast our presence: The devices do so as long as they are on, even if we are not explicitly communicating.

This change is profound. When society experiences such profound change, our constructs, including the law, must correspondingly respond. That principle has been recognized for over a century, in for example, the 1910 Supreme Court opinion in Weems v. United States:

Legislation, both statutory and constitutional, is enacted, it is true, from an experience of evils but its general language should not, therefore, be necessarily confined to the form that evil had theretofore taken. Time works changes, brings into existence new conditions and purposes. Therefore a principle, to be vital, must be capable of wider application than the mischief which gave it birth.

That point is cited in Justice Brandeis’s famous dissent in Olmstead. The Weems opinion affirms the importance of law being interpreted in the face of societal and technological change. A 2001 case, Kyllo v. United States, has more recent bearing on the issue. Kyllo involved warrantless use of a thermal imager outside a house to determine the heat map inside (thus determining that marijuana was being grown in the building). The Supreme Court ruled that the fact that the search was carried out from outside the house did not negate a warrant requirement. Echoing the philosophical point raised in Weems, in Kyllo the court stated, “It would be foolish to contend that the degree of privacy secured to citizens by the Fourth Amendment has been entirely unaffected by the advance of technology.”

While it is challenge to understand how a Supreme Court nominee will interpret constitutional issues in light of such societal and technological changes, it is critical that we do so. Orin Kerr has analyzed Judge Brett Kavanaugh’s Fourth Amendment jurisprudence, concluding that Kavanaugh takes “government interests very seriously” but doesn’t appear to have a broader agenda. Given the importance that mobile communications have for privacy, I believe that Kavanaugh’s opinion in Klayman v. Obama, a case challenging the constitutionality of the National Security Agency’s bulk collection of phone metadata, deserves deeper scrutiny.

In his short, two-page opinion, Kavanaugh relied on what he viewed as precedent to dismiss Klayman’s motion for an en banc review, essentially ending the case. The brevity of Kavanaugh’s opinion shows that he viewed Klayman as an open-and-shut case. I think that Kavanaugh’s failure to engage in the changing technologies as well as in broader implications of several recent Supreme Court opinions resulted in a misreading of the issues and an incorrect ruling. Briefly, changes in technology have created different fact patterns; prior opinions are not as apropos as Kavanaugh seemed to think.

The procedural history of Klayman include an initial ruling in the plaintiffs’ favor but with a stay permitting government collection to continue, followed by a ruling by the D.C. Circuit holding that the plaintiffs lacked standing. The plaintiffs rushed to establish standing, filing again with the addition of parties whose telephone records were likely to have been collected by the government, before the passage of the USA Freedom Act could moot the case. After a ruling by the U.S. District Court for the District of Columbia barring the bulk collection, the government immediately appealed to the court of appeals for a stay, which was granted. The plaintiffs then requested an en banc hearing to remove the stay, which the appeals court rejected in an order written by Kavanaugh—effectively ending the case.

Kavanaugh’s argument is essentially:

I vote to deny plaintiffs' emergency petition for rehearing en banc ... [I]n my view, the Government's metadata collection program is entirely consistent with the Fourth Amendment ... The Government's collection of telephony metadata from a third party such as a telecommunications service provider is not considered a search under the Fourth Amendment, at least under the Supreme Court's decision in Smith v. Maryland, 442 U.S. 735 (1979) ... Even if the bulk collection of telephony metadata constitutes a search, cf. United States v. Jones, 132 S. Ct. 945, 954-57 (2012) (Sotomayor, J., concurring), the Fourth Amendment does not bar all searches and seizures. It bars only unreasonable searches and seizures.

Kavanaugh’s opinion adhered to what he viewed as previous precedent. But his opinion missed some crucial details. The precedent cited, Smith v. Maryland, concerned collection against an individual. In Smith, the court ruled that as the telephone metadata—number called, time, length—had been shared with a third party, government collection from the communications provider did not require a warrant. At the time, no specific legal instrument—no court order, subpoena, or warrant—was required to conduct the metadata collection; the 1986 Electronic Communications Privacy Act (ECPA) later established a legal process for that collection, requiring that communications metadata be “relevant and material” to an ongoing investigation.

Crucial to Klayman was the fact that collection was undertaken in bulk; thus almost none of it would have satisfied the criteria of being relevant and material to an ongoing investigation. Kavanaugh cited instances of mass surveillance—“drug testing of students, roadblocks to detect drunk drivers, border checkpoints, and security screening at airports”—but those were all instances in which no specific legal instrument is required for the surveillance to occur. ECPA put one in for communications metadata, and thus the analogies of drug testing of students, roadblocks to detect drunk drivers, etc. fails to hold. ECPA couldn’t be used in this case, nor does Smith really apply, since the collection is bulk. The Smith “precedent” is far from solid. By contrast, while under Smith, there had been no such legal instrument, ECPA changed that. The analogy fails to hold.

But there was a novel way to look at the Fourth Amendment issues in Klayman v. Obamaone suited for the times—that is supported by a prescient Supreme Court concurrence, a scientific inquiry, a second Supreme Court opinion, and one important fact. All bear on Klayman, but none of the arguments were addressed in Kavanaugh's decision.

The prescient concurrence was Justice Sonia Sotomayor’s in United States v. Jones. The court ruled that a GPS device placed on a car constituted a search; Sotomayor concurred, noting how technologies are changing the world. The Jones decision was about searching phones, not collecting metadata, but that isn’t the point. Sotomayor’s argument about reconsidering whether an individual has a reasonable expectation of privacy in information voluntarily disclosed to third parties is nonetheless as applicable to metadata collection as it is to searching phones. In fact, in her concurrence, she explicitly mentions telecommunications metadata:

More fundamentally, it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. E.g., Smith, 442 U. S., at 742; United States v. Miller, 425 U. S. 435, 443 (1976) . This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers. Perhaps, as Justice Alito notes, some people may find the "tradeoff" of privacy for convenience "worthwhile," or come to accept this "diminution of privacy" as "inevitable," post, at 10, and perhaps not. I for one doubt that people would accept without complaint the warrantless disclosure to the Government of a list of every Web site they had visited in the last week, or month, or year. But whatever the societal expectations, they can attain constitutionally protected status only if our Fourth Amendment jurisprudence ceases to treat secrecy as a prerequisite for privacy. I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection. See Smith, 442 U. S., at 749 (Marshall, J., dissenting) ("Privacy is not a discrete commodity, possessed absolutely or not at all. Those who disclose certain facts to a bank or phone company for a limited business purpose need not assume that this information will be released to other persons for other purposes."); see also Katz, 389 U. S., at 351-352 ("[W]hat [a person] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected").

The marker and philosophical groundwork that Sotomayor laid out was bolstered by research of two Stanford University students. In the aftermath of the Snowden disclosures, Jonathan Mayer and Patrick Mutchler examined what personal information they could learn from users’ telephone metadata (the data of which number called, for how long, when). In 2014, they posted their results on the sensitivity of telephone metadata, a post that was the basis of a paper in the Proceedings of the National Academy of Sciences in 2016. Mayer and Mutchler were surprised by the sensitivity of the data they collected. They observed that 57 percent of participants in their volunteer study made at least one call to health services, 40 percent did so to financial services, 30 percent to a pharmacy, 10 percent to legal services; using other sources of data to check, they discovered, for example, that they could identify the religion of 73 percent of participants simply from call metadata.

Drilling down on the survey participants’ metadata revealed far more sensitive information about the people involved. By correlating call metadata information with public sources of data, Mayer and Mutchler learned that:

Participant A communicated with multiple local neurology groups, a specialty pharmacy, a rare condition management service, and a hotline for a pharmaceutical used solely to treat relapsing multiple sclerosis.

Participant B spoke at length with cardiologists at a major medical center, talked briefly with a medical laboratory, received calls from a pharmacy, and placed short calls to a home reporting hotline for a medical device used to monitor cardiac arrhythmia.

Participant C made a number of calls to a firearm store that specializes in the AR semiautomatic rifle platform. They also spoke at length with customer service for a firearm manufacturer that produces an AR line.

In a span of three weeks, Participant D contacted a home improvement store, locksmiths, a hydroponics dealer, and a head shop.

Participant E had a long, early morning call with her sister. Two days later, she placed a series of calls to the local Planned Parenthood location. She placed brief additional calls two weeks later, and made a final call a month after.

Mayer and Mutchler’s observations demonstrated that communications metadata is remarkably revelatory.

Meanwhile, in 2014, the Supreme Court ruled in Riley v. California that cell-phone searches require warrants. The government had argued that a cell phone search was like a search of other material during an arrest, but the court ruled that the search required a warrant:

The United States asserts that a search of all data stored on a cell phone is 'materially indistinguishable' from searches of these sorts of physical items (Brief for 17 Cite as: 573 U. S. _ (2014) Opinion of the Court United States in No. 13-212, p. 26). That is like saying a ride on horseback is materially indistinguishable from a flight to the moon. Both are ways of getting from point A to point B, but little else justifies lumping them together. Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse.

Riley addressed cell phone searches, not metadata collection. But the case suggests that technological change can create a materially different fact pattern—one that has implications for the courts. In Riley, California and the Justice Department argued that a search of a cell phone coincident with an arrest was like the search of an accompanying cigarette pack, wallet, or purse: no search warrant needed. The Supreme Court strongly rejected that analogy, stating that a change in technology akin to the difference between “a ride on horseback” and a “flight to the moon” creates a notable difference in privacy concerns.

Mayer and Mutchler’s research demonstrated that searching telephone communications metadata in 2015 exhibited that same level of “material distinguishability” from a search in 1979, the time of Smith. Though there is no legal obligation for a judge to acknowledge such information, I believe that in light of Riley and changing technologies, Kavanaugh ought to have considered whether metadata usage constituted “a flight to the moon”—and thus deserved stronger privacy protections.

Think about Kavanaugh’s opinion in light of Justice Sotomayor’s concurrence, the Mayer and Mutchler research, and the Riley opinion, all of which appeared in the period 2012–15, prior to the Klayman decision. Kavanaugh failed to acknowledge—much less account for—technological changes in government surveillance capabilities. This was after Supreme Court opinions had explicitly recognized the importance of such changes in interpreting the Fourth Amendment jurisprudence.

In her concurrence, Sotomayor made the salient point that a difference in the level of metadata collection should result in a difference in the legal protections of such information. As Mayer and Mutchler demonstrated, communications metadata circa 2015 was a very different beast than communications metadata collection in 1979 (the time of the Smith decision). In between, in the 2014 Riley decision, the Supreme Court ruled that a difference in scale of personal information discoverable—the difference between searching a cigarette pack, a wallet, or a purse and searching a cell phone—may form the difference between needing a search warrant and not.

Since Sotomayor’s concurrence was not a majority opinion, Kavanaugh was not obliged to respond to her opinion. But Kavanaugh’s failure to address the points raised by Riley and to take into account changing times and technologies is a serious one: The judge did not take into account changing times and technologies. The result was a 2015 opinion based on 1979 reasoning, reasoning that omitted the fact that the 1979 ruling involved collection against an individual rather than bulk collection. The opinion represents a serious failure to recognize the changes the Digital Age was bringing to privacy and surveillance. Those changes formed the basis of Supreme Court decisions in closely related cases (the 2014 Riley case and a case decided post-Klayman, Carpenter v. United States).

Kavanaugh’s Klayman decision is concerning in light of decisions that the Supreme Court will face in the near future. Consider, for example, the June 2018 Carpenter ruling, in which the court ruled that seven days of collection of cell site location data is a search—and thus requires a warrant. Left open is the issue of how many days’ worth of collection needs a warrant. Three? Five? Half a day? We don't know. But this issue, and many like it, will be before the Supreme Court in the years to come. And having a Supreme Court justice who understands how, “Time works changes” and “brings into existence new conditions and purposes” will be vital to preserving privacy. Does Kavanaugh?

Kerr observed that Kavanaugh’s opinion in Klayman may simply be showing deference to the government, which argued national security needs for the bulk metadata collection. Perhaps the opinion is also a demonstration of Kavanaugh’s strong aversion to overruling past precedent, given that Kavanaugh chose to read Smith as precedent—which is not necessarily required given the changes that occurred in the ensuing decades (ECPA, the fact that Klayman concerned bulk metadata collection, the decisions in Kyllo and Riley). But because Smith v. Maryland concerned metadata collection against a particular individual and not bulk collection, it is not at all clear that Smith is precedent for the Klayman case.

For that reason, Kavanaugh’s opinion suggests that the judge lacks understanding of the need for the law to accommodate the profound changes that modern technologies are bringing to activities of everyday life. Such a view is in tension with the vision of the Fourth Amendment expressed in Kyllo, a decision penned by the late Justice Antonin Scalia.

That the Klayman opinion ignored the direction of Riley and the privacy concerns raised by metadata, as demonstrated by Mayer and Mutchler, is quite disturbing. If Klayman is a demonstration of the judge’s unwillingness to consider how technological changes have affected rights afforded by the Fourth Amendment, that would make him a dangerous person to sit on the Supreme Court. It is critical Americans learn far more about Kavanaugh’s views on protecting privacy in the digital age before the Senate confirms a Supreme Court justice who fails to address citizens’ privacy in the face of the distance we have traveled from 1979.


Susan Landau is Bridge Professor in The Fletcher School and Tufts School of Engineering, Department of Computer Science, Tufts University, and is founding director of Tufts MS program in Cybersecurity and Public Policy. Landau has testified before Congress and briefed U.S. and European policymakers on encryption, surveillance, and cybersecurity issues.

Subscribe to Lawfare