Smartphone Searches Not So Smart—Analysis

Cellebrite UFED

Cellebrite Mobile Synchronization, LTD.

This week, reports surfaced of police in Michigan using forensic devices that can quickly scan the contents of your phone during routine traffic stops. The Michigan State Police has denied using the devices without a warrant or consent, and PM columnist Glenn Reynolds argues that such searches would be illegal. But, he says, it’s the bigger picture that’s truly worrisome: The combination of smartphones loaded with data about you and law enforcement devices that can easily extract that information means that a privacy war is looming.

As Popular Mechanics reported earlier in the week, reports have surfaced that police in Michigan are using an electronic device, the Cellebrite UFED, that can pull data off a variety of cellphones and smartphones, including Android devices, iPhones and iPads. According to Cellebrite’s website, its UFED can obtain email, Web bookmarks, Web history, SIM data, cookies, instant messages, Bluetooth devices, GPS fixes, call logs, contacts and much more from your phone.

That police are using such a device might be troubling in itself, though it’s easy to imagine legitimate law-enforcement uses for that kind of data. But what’s more troubling is that they may not be using it in the course of major investigations into drugs or terrorism where that might make sense. Instead, the letter by the American Civil Liberties Union that sparked this controversy alleges that Michigan police are using it to snoop through smartphones at random traffic stops. The Michigan State Police are now denying such use, and say they only use the devices with a warrant, or with a person’s consent. (Why would you consent? Beats me.)

Regardless of what’s actually going on in Michigan, these reports have led many people to wonder: Can that kind of random cellphone search possibly be legal?

Probably not. Traditionally, a police officer may search a person when he makes an arrest. But a traffic stop isn’t an arrest. A police officer who pulls you over for an illegal lane change can arrest you if he sees contraband—a bag of marijuana, say—in plain view, but he cannot search your car just to see what he turns up. There’s even less justification for searching a cellphone. Even with an arrest, a warrant may be required to search a closed container: Just last year, the Ohio Supreme Court held that a cellphone is analogous to a closed container and cannot be searched without a separate warrant—and that’s for a search where someone has actually been arrested for a crime, not mere snooping during a traffic stop.

Without an arrest, search requires probable cause—the officer must have some reasonable basis for believing that a crime has been committed, and that a particular search will turn up evidence relevant to that crime. It’s hard to see how cellphone data could be relevant to a traffic stop. Instead, searching cellphones looks more like a fishing expedition: Having gotten access to you with a traffic stop, officers are just looking around to see what they find. That’s explicitly forbidden by the Constitution, and with good reason. Letting government officials snoop on anyone they choose, for no particular reason, is a bad idea.

If you consent to a search, however, all bets are off. It’s hard to see why anyone would do so: If you’re a criminal, you’ve got something to hide; and if you’re not a criminal, why would you want to let the police paw through your email? And remember that when you consent to have your smartphone searched, you’re also giving up data on all your contacts, who haven’t consented. The legal ramifications to that have yet to be worked out.

This is just the beginning of a new era of privacy invasions and legal complications, particularly those surrounding your phone or other mobile device. For example, your smartphone contains a lot more information about you than your emails and the numbers in your address book. Your phone knows where you’ve been and what you’ve done. Consider the recent revelations that Apple iPhones actually maintain an internal file of the user’s locations, one that is copied to the user’s computer when the phone is synchronized to iTunes. These phones may store as much as a year’s worth of location data—data that could be snooped by law enforcement, creditors, jealous spouses, or— more troubling, and probably more likely—hackers, malware operators and stalkers.

What happens if police gain access to all this information through your phone? Courts are only beginning to grapple with this. Take the question of location tracking: One federal magistrate has held that the government must have a warrant even to obtain cellphone tracking information from a cellular carrier. The cellphone system routinely logs which cell towers contact your phone as you travel about, and that data provides a pretty good map of your whereabouts. It’s a good enough map, the court decided, that police shouldn’t be able to access it without a warrant. Likewise, the U.S. Court of Appeals in Washington, D.C., ruled that installing a GPS tracker in your car requires a warrant. However, other cases have held that putting GPS tracking devices on suspects’ cars doesn’t require a warrant—the argument is that whenever you drive your car, you’re in public view, and thus have no expectation of privacy regarding your whereabouts, so you’re not harmed by the tracking. (I feel certain, however, that if I went down to the nearest federal motor pool and installed GPS trackers on their vehicles, they’d take a different view.)

Experts have been warning of privacy threats for years, and for the most part the public has yawned. But the combination of devices that gather all sorts of information about you and law-enforcement agencies wanting to snoop on it has put us into a whole new ballgame.