United States law enforcement officials have been utilizing data provided by global positioning satellite systems to track down individual suspects, without having to demonstrate probable cause before a judge first – that much is known. Rights groups such as the ACLU have wondered, just how much of that goes on?
The rights group’s investigation of this practice has inadvertently triggered a renewal of the debate over privacy policy versus public disclosure, and whether it’s possible for an agency or other entity to reveal data that could lead to further revelation of personally identifiable data (PID), without officially violating privacy. The final outcome could set a new precedent for privacy policy, not just by the government but for enterprises as well.
In trying to obtain Freedom of Information Act data about the practice, the ACLU found itself blocked by the Justice Dept. The reason: DOJ believed that disclosure of the cases where warrantless GPS tracking was used, would violate the privacy of the suspect, especially if that suspect turned out not being guilty in the first place.
In other words, giving the ACLU enough data for it to ascertain the circumstances in which GPS tracking was used by law enforcement against innocent civilians, could harm innocent civilians.
Yesterday, a three-judge panel of the D.C. Circuit Court of Appeals issued a ruling that essentially re-opens the question, with a partial remand back to the lower court. The ruling essentially upholds the lower court’s finding that the Justice Dept. should turn over data regarding instances of GPS tracking of suspects, in cases where suspects eventually pled guilty or were convicted. The judges’ logic: Since convictions and guilty pleas are public knowledge anyway, revealing the bits of data that link those results to the investigative methods used would not cause greater than negligible harm.
The judges seemed to side with rights groups, ironically by saying the DOJ’s concern about protecting the rights of the accused may be overblown. This time it’s the rights groups that want to know the identities of the cases involved, if not the parties’ names themselves; and this time it’s the DOJ that’s on the side of protecting that information. The judges cited prior cases that established a clear distinction between the government exposing a suspect’s entire rap sheet, and instead disclosing bits of data that a diligent researcher (if he were interested) could compile to produce a whole rap sheet.
It’s the bits of data versus the whole data. If this is beginning to sound familiar – like the argument over whether disclosing a user’s IP address is the same as disclosing his name – it should. Here’s a key excerpt from the Appeals Court’s ruling yesterday:
“In this case, however, disclosure will reveal only the “bits,” not the ‘whole.’ As already discussed, the most that disclosure is likely to lead to is the fact of a single conviction, not a comprehensive scorecard of a person’s entire criminal history across multiple jurisdictions. Nor is there a web of statutory or regulatory policies obscuring that information, nor much expense nor logistical difficulty in gathering it. To the contrary, computerized government services like PACER make it possible to access court filings concerning any federal defendant from the comfort of one’s home or office, quite unlike the ‘diligent search of courthouse files, county archives, and local police stations throughout the country’ that a citizen would have had to undertake to replicate the contents of a rap sheet… In addition, newspapers regularly report on federal prosecutions, and their accounts can easily be found on the Internet. Indeed, by routinely issuing press releases that name the individuals that it has indicted, and then naming them again when they plead guilty or are convicted, the Justice Department has itself made the process infinitely easier. If someone wants to know whether his neighbor or potential employee has been indicted for, convicted of, or pled guilty to a federal offense, he may well find out by simply entering a Google search for that person’s name.”
Here, the Appeals Court makes the argument (leaving it at an argument and not really a declaration) that a person’s privacy may only be infringed upon if enough neighbors or others were interested enough in that person to do the investigation themselves. “It is little more than speculation to suggest that friends or associates who did not learn of a conviction at the time it occurred (whether through press accounts, press releases, or other means) will hear of it for the first time merely because the Justice Department releases a list of docket numbers, courts, and case names,” the judges write.
The key to this part of the argument is the judges’ presumption that a privacy violation takes place when people are given access to PID. This may go against the contention of rights groups and others that privacy may be violated when a database is populated with PID, before any human beings have even seen it.
If the judges’ arguments are given weight, then much of the foundation for current legislation mandating that services such as Google and Facebook explicitly ask their users’ permission before PID is disclosed to a Web service, may inadvertently corrode.
Nonetheless, the ACLU late yesterday trumpeted the judges’ decision as a victory, since it gives the group access to at least the “bits” without handing over the “whole.” As the ACLU’s Jay Stanley wrote last night, “Everyone acknowledges that the government has a right to keep the details of particular investigations secret, but when the government adopts whole new policies that affect our society’s privacy rights in very broad ways – that is something that should be decided democratically, and that can’t happen if we don’t even know what’s happening.”
