As the “internet of things” expands in power and scope, concerns build about individual privacy and the potential consequences of “smart” technology for due process as we know it. Industry giant Apple and its coveted, leading-edge product line are predictably at the forefront of the controversy.
Jailbreaking...but not the kind they probably hoped for
Law enforcement cannot compel a person to recite the combination of a safe [1] whose contents might incriminate him or her, but what about the passcode to a mobile phone [2]? What about iPhone’s facial-recognition mechanism for access? If your face is the key with which you unlock your device, how can that be private information? Should an officer need your permission [3] to use your face? How about unlocking a device [4] with your fingerprints? Your fingerprints themselves, after all, are not private information in the eyes of the law [5]. And if you’re dead – can investigators use your cold, dead fingers? In the case of one defendant, they sure tried [6] -- with about the same luck any of us has on a cold day. (Maybe they should just make their own lifelike replicas of your cold dead fingers [7]!)
Settled law, disruptive technology
In 2014, SCOTUS ruled unanimously in Riley v. California that police who seize a mobile phone upon arrest cannot, under most circumstances, conduct a warrantless search of the device’s ESI. [8] Seizure, in this case, is not unreasonable, but searches generally still require a court order, or “exigent circumstances,” a phrase whose meaning they clarified in their Missouri v. McNeely decision the previous year [9]. Local police may continue to push that envelope, and citizens under arrest will not always be well-equipped to push back.And each time the law catches up to the state of the art, technology finds a new way to outpace it.
The popular Apple Watch Series 4 adds a new level of complexity to this dilemma, with its built-in capability to dial 911 on behalf of a wearer who has fallen and is unresponsive, and to transmit the wearer’s GPS location to dispatch, if certain false-alarm failsafe protocols are not activated [10]. This might appear, on its face, to be little more than a modern-day version of the LifeAlert button (“I’ve fallen! And I can’t get up!”). But the LifeAlert system is purpose-specific: no one wears it without knowing it does this. A typical Apple Watch user could be unaware of the device’s capability to communicate information to first-responders; the function seems almost ancillary to the other myriad things the watch can do.
The wearer could also be unaware of a crucial limitation on his or her Fourth Amendment Rights, to wit: the community caretaking exception [11], which allows police to enter private property if they believe emergency assistance is needed. This clause creates the potential for timely lifesaving aid to be rendered when a person in grave danger is incapacitated. It also has the potential for misapplication or abuse.
D***it, Janet!
Suppose, in your haste to get to work, you leave your Apple Watch on the dresser. Your beloved ferret, Janet, finds it. She carries it around for a while, looking for a nice place to hoard it, but as she schleps her way along the tops of your kitchen cupboards, a sneeze overtakes her, and she drops the watch from her teeth. Apple Watch sensed movement until now, and now it has detected a “fall.” It blares an alarm and prompts you with response options: whether you fell or not, whether you’re OK. Only, you’re not there to respond.
Your ferret scurries back along the shelves, knocking down a cookie jar, and finally she hides in the spice rack while the alarm blares for several more minutes. Police arrive as they would on a standard “welfare check” [12]. They knock on your door, and, hearing no response, they break in. They find no casualties, of course, save for the blaring watch on the kitchen floor...and your massive stash of weed, in the shards of the cookie jar Janet smashed during her hasty retreat.That hypothetical may be far-fetched, but there are countless, less-cartoonish permutations of this scenario, with potentially life-changing implications. Although the Series 4 has this emergency alert function as an “opt-in” feature, few users are likely to weigh the benefits against the risks of said opting. The admissibility of evidence obtained under such circumstances may come to be a subject of rigorous debate.
Are you OK? Please respond.
Reflection questions for the class:- What are the Fourth and Fifth-Amendment rights at stake if an Apple Watch “narcs” on its owner? Can the contents of your broken cookie jar be seized and used as evidence against you?
- What pros and cons do you see if Apple allowed users to program an emergency contact known to them personally, in lieu of 911 dispatch?
- As our “smart” devices implement more and more biometric security features, how else might other technological advances (such as 3D-printed prosthetics) play a role in their subversion?
Sources and further reading
[1] Doe v. United States, https://caselaw.findlaw.com/us-supreme-court/487/201.html[2] “Florida Man Jailed for Refusing to Disclose Smartphone Passcode,” The Washington Times. https://www.washingtontimes.com/news/2017/may/31/christopher-wheeler-florida-man-jailed-for-refusin
[3] “Can Cops Force You to Unlock Your iPhone with Your Face?” Findlaw. https://blogs.findlaw.com/blotter/2018/10/can-cops-force-you-to-unlock-your-iphone-with-your-face.html
[4] “The government wants your fingerprint to unlock your phone. Should that be allowed?” LA Times. http://www.latimes.com/local/california/la-me-iphones-fingerprints-20160430-story.html
[5] “Fingerprints: The First ID” FindLaw. https://criminal.findlaw.com/criminal-procedure/fingerprints-the-first-id.html
[6] “Yes, Cops Are Now Opening iPhones with Dead People’s Fingerprints.” Forbes. https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-cops-are-now-opening-iphones-with-dead-peoples-fingerprints/#69ebba13393e
[7] “Michigan police 3-D printing murder victim’s finger to try to unlock his phone.” Rawstory. https://www.rawstory.com/2016/07/michigan-police-3-d-printing-murder-victims-finger-to-try-to-unlock-his-phone
[8] Riley v. California. Bloomberg Law. https://www.bloomberglaw.com/public/desktop/document/Riley_v_California_No_13132_and_13212_US_June_25_2014_Court_Opini?1539112343
[9] Missouri v. McNeely, Oyez. https://www.oyez.org/cases/2012/11-1425
[10] “Apple Watch’s new auto-911 calls after falls may tumble into legal trouble.” Arstechnica. https://arstechnica.com/tech-policy/2018/09/how-the-new-apple-watch-will-call-911-after-a-fall-if-you-want-it-to
[11] United States v. Cervantes, USCourts.gov. http://cdn.ca9.uscourts.gov/datastore/opinions/2012/05/16/09-50521.pdf
[12] “What is a Police Welfare Check?” Black’s Law Dictionary. https://thelawdictionary.org/article/what-is-a-police-welfare-check/
Erin, I could read your version of hypothetical news ALL DAY. Kudos on the entertaining post and also thanks for the heads-up on the legal complexities of the “time-saving” technological advancements we have come to rely so heavily on. This along with our last class discussion have me wanting to re-activate my antiquated flip phone.
ReplyDeleteLiving in the information era presents ever increasing tension between privacy and security concerns. Following terrorist attacks such as 9/11 and more recently the 2016 shootings in San Bernardino, “Americans back at least some extra steps by the law enforcement and intelligence communities to investigate terrorist suspects, even if that might infringe on the privacy of citizens. But many draw the line at deep interventions into their personal lives.” (http://www.pewresearch.org/fact-tank/2016/02/19/americans-feel-the-tensions-between-privacy-and-security-concerns/). My feeling is that the average citizen doesn’t become actively concerned about protecting his/her privacy until it directly impacts their lives (e.g. consumer data breaches).
One of the topics that interests me is the security of electronic systems over analogue systems. I watch a bunch of car review videos and one feature the host mentions is the need of a key in addition to the key fob system. If the car battery or the key fob battery goes dead, the only other option to get the car going would be to use a manual key. The use of the fob is convenient for sure and may be important in an emergency situation, but there are ways for crackers to get access to your key fob wireless data to be able to break into your car. Same goes for your garage door opener.
DeleteA big part of this problem is data encryption and the lack of encryption use in devices part of the internet of things. Just because you have amazing computer security does not prevent a cracker from access your Nest or fridge and being able to backdoor into your private data. I believe this is part of the worry that Vice President Cheney had with his pacemaker. At the time, and I think currently, pacemaker system data was not encrypted because the thought never occurred to the designers and engineers. Now, these vulnerabilities can be exploited as access points to breach more secure systems.
Beyond better data security and encryption, the question is whether the convenience of Internet connected devices override the potential security flaws.
Erin, I realize your scenario was "cartoonish" but I can imagine many instances in which people may not want someone bursting into their private residence. I mean, I don't even like a surprise visitor if I haven't dusted and vacuumed! We spend a lot of time focusing on the benefits of technology and failing to anticipate the disadvantages. But sometimes, we WANT someone to breach our privacy. For example, a couple of years ago I launched an investigation at work. There was an allegation against a former staff member who asserted his/her innocence. We asked the individual to turn over text messages and iMessages from more than one year prior. The individual would have been happy to do so to prove his/her innocence, but was certain all of that information had been deleted. When we enlisted the assistance of a forensic computer expert, we were able to locate "deleted" text messages/iMessages that were from the time period we were looking for. Unfortunately (in this case), Apple has a very sophisticated form of deindexing and encryption system. No one knows exactly what the deletion process is for identifying which information will be accessible and when. As a result, we were able to gather all kinds of text/iMessages, which the individual believed would completely exonerate him/her of the allegations. Due to Apple's savvy technology, the text threads were incomplete. Some texts were there, but due to the missing responses, in some cases there was not enough context to understand what happened and in other cases, it actually made the situation worse! After much digging through thousands of texts, iMessages, and e-mails, we were able to put the pieces together and determine the individual was telling the truth. The investigation lasted more than a year but if we had been able to gather the texts from the phone, the whole matter would have been resolved in days. The individual was so distraught at the allegation and wished he/she had somehow maintained all the data but we never really know when we are going to need it, right?
ReplyDeleteIt is little understood that phone and computer data that is deleted isn't actually removed from the computer. Until that data is overwritten, it can still be accessed and pieced together. I've had trouble with computers and phones crashing and have purchased software to recover a number of documents. In some instances, there was data corruption and pictures were missing some of the information, but you could still tell what the picture was of.
DeleteMost people are savvy enough to realize that electronic data needs to be shredded, not just deleted, in order for that data to be inaccessible.
Peter, I must be part of the minority! I truly thought once I "deleted" something, it was gone. I think that while many understand data needs to be "shredded" to be permanently inaccessible, I think it is interesting that the general public has such little understanding of companies' secretive systems for "shredding." I'd be curious to understand better how this protects our privacy.
DeleteErin--so interesting! I personally feel better running on trails and outside with my Apple Watch, knowing that if I get into trouble I can summon help quickly. The emergency alert function was a plus for me, as I often run on empty trails. What if a serial killer caught me? What if I tripped and fell? Knowing that I had help immediately increased my enjoyment of my runs. However, you bring up very, very interesting points, the facial recognition feature on my phone being one of them. And even though you call your example cartoonish, it makes me wonder about the implications of law enforcement. What happens if they get so many false calls they stop responding urgently? You've given me a lot to think about since I've only seen the positives of using the 911 on the watch. I don't know, though, if having the app call my husband, mother, or children would help me feel as safe as having a dispatcher at the ready. The example that comes to mind is when I was running on the Provo River trail, I was on a stretch by myself. Out of nowhere a man came out of the woods and began following me. I was terrified, but I did have my watch on so I knew I could get help. Not long after I found a group of people and sort of stayed with them. As I'm thinking back over this situation, I think knowing that I could summon 911 quickly helped me to think clearly and know I had an option help me. I'm not sure if having an emergency contact would give me that same relief. However, your example has me really rethinking this.
ReplyDeleteI'm curious about the involvement of 911 in these instances. I know for certain alarm companies, they will not respond unless someone is home and I have heard that police often fine people for false alarm responses. Is it standard operating procedure for the police to still be directly involved in responding or is the private company set up to handle the response?
DeleteIn response to the Fourth and Fifth amendment rights, I would think the police would need to obtain a search warrant if they wanted to seize the weed. The reason for the forceful entry was to see if an individual needed help. The marijuana is a separate issue and maybe not an issue at all depending on what state you live in. Ha, ha! However, the law enforcement do have an obligation to act when they discover illegal activity. Yes, our electronics can get us into unintended trouble, but a ferret can too!
ReplyDeleteIf the weed was in plain view of the area that the police had reasonable access to, there is no need for a further search warrant and the search is legitimate and may lead to probably cause for further searches.
DeletePersonally I don’t feel as though your rights are at stake if you are volunteering to wear devices that track and store all this personal data. If this information was being stored without your consent that would be one thing, but you consciously choose to wear this device and volunteer to submit this information and use different features. Can the contents of the broken cookie jar be seized and used as evidence against you? I would argue yes. The police had probable cause to enter the property based on the alarm notifying them of an emergency through the Apple watch. By “opting-in” and using this emergency feature, you are asking for the police to respond when they are notified by this alarm. If you are concerned about what they might find, then you have the option of protecting your privacy and shouldn’t use the feature.
ReplyDeleteAgreed, provided this is in the terms and conditions, I don't see an argument of how this evidence can be excluded based on the facts we were given.
DeleteTNT, I agree. I think by actively purchasing and using the device, you are consenting to allow the company, and law enforcement, access to your data. In fact, I think I had to consent to use my Garmin watch when I set it up through the app. Unfortunately, I think many of us just click through the terms and agreements without really understanding how use of the products impacts us.
DeleteKate's absolutely right. I think the Venn circle of "informed consent" is nestled well inside the larger circle of "consent" for these purposes.
DeleteI remember thinking about this a great deal as I was setting up my interviews for Prof. Marshall's class. I noticed both my interviewees were keen to discuss just about ANYTHING offline, but our texted/digital communication was decidedly terse. As an accountant, I've got my own uptight ideas about what kind of messages are best transmitted in which channel. (Matter of fact, I've talked about that very thing to at least two lawyer friends in as many weeks. I'd tell you some funny stories, but then I'd have to make you sign an NDA.)
Erin your hypothetical is a great example for welfare check. The Supreme Court of the United States carved out an exception to the warrant requirement of the Fourth Amendment by recognizing the legitimacy of searches and seizures based on community caretaking or public safety considerations.
ReplyDeletePolice can use their Fourth Amendment to call their search and seizure of a person a wellness check. It is true, but usually it is an excuse to search someone without a warrant or probable cause. The law states that if a police officer has "reasonable belief" that someone inside a residence is in need of aid, the police officer's community caretaking duties, and emergency aid doctrine, justify a warrantless entry into a home. In some cases, this is used to break in into the privacy of citizens, but what if they see a bag of cocaine on a table? Could they then arrest him for drug possession? Then Jurisdiction plays a big role here, drug offenses may be prosecuted in state court or federal court. Knowing the also Federal jurisdiction covers drugs. Then welfare check has fulfilled its duty.
No court order is required for a police to conduct a welfare check. This might be a good example of a mandatory ARBITRATION CLAUSE as well. Keeping in mind that we sign or agree contracts on some devices that waive our rights to sue a provider company. This might be one of them on the Apple Watch.
Supreme Court Rules 911 Tapes are Admissible in Lieu of Witness Testimony that will mostly apply in criminal cases such as domestic violence, based on the confrontation clause of the sixth amendment if there is not an available witness, might be used.
Very good post Erin, with technology always outpacing everyone else this does seem like there may always be questions revolving the aspects of technology as they pertain to the law.
ReplyDeleteThere are obvious benefits to having quick access to 911 on wearable devices. There may also be some disadvantages. In the case of your hypothetical scenario it could waste resources by increased volume of 911 misdials, but that is speculation as I do not know the effects this function actually has on those volumes. There could be cases in which a 911 call is necessary, but there are many cases in which a programmed individual in your life to assist you just as well. I would say to protect the consumers from unwanted “invasion of privacy” give them three options: 1) Make it required to either select a 911 setting (with terms and conditions linked). (2) Give the option to alert other individual (emergency contact) in case of an emergency. (3) The option to not utilize the feature. I think any evidence collected from responses now fit within the 4th and 5th amendments, however this would solidify the argument.
This was a fun post to read! Great job, Erin! This post and the information provided in the last class has given me a lot to think about with respect to the internet of things and security and privacy issues. We're all concerned about data security and privacy, but when is that last time any of us has actually read the Apple User Agreement in its entirety? When is the last time we set a ten digit passcode on our phones to make it harder for someone to bypass? We rely so much on tech companies to protect our information, but see time after time just how easily data can be hacked through loopholes or just plain, weak security within the device software. I think most individuals who purchase these items likely haven't given much thought to what happens to the data, and less of where its stored, who can access it, etc. rather than the fact that the item is cool, convenient, and perhaps that it makes life easier for them.
ReplyDeleteThe idea of 3D printed prosthetics being an security issue is really interesting. 3D printers are fairly sophisticated, and can simulate the texture and overall feel of human body parts. I recently read an article about a study being done at the National Institute of Standards and Technology, where they have identified a potential "security loophole" that has demonstrated that 3D hand and finger prosthetics can actually reproduce a real fingerprint which could potentially be used in a variety of ways. It's pretty scary to think about, particularly as we move towards a world in which we are reliant more and more upon advanced technology which, as you have correctly pointed out, is moving way faster than the law can catch up to it.
The Fourth Amendment states: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. Whereas the Fifth Amendment includes, “nor shall private property be taken for public use, without just compensation.” Referring to Erin’s scenario (which I loved, Erin!) I agree with Kate in her statement that by purchasing the Apple watch, Fitbit, whatever it might be, one is agreeing to these certain terms and conditions. However, it is obvious that Apple would have neatly stated that “if 911 is called and drugs are found at the scene, that person will be subject to the law” etc. which would be up to the litigator to interpret. I read Peter’s comment on the drugs being in plain view that there would be no need of a further search warrant - which I thought was very interesting and is discussed here* in regards to the Fourth Amendment. I would have initially thought that charging someone for massive amounts of weed that was discovered when a false 911 call was made and police entered a home without permission would be denying this person due process. After reading Peter’s comment and applying it to this situation (previously accepting terms and conditions on the watch), I can see where this search would not be considered unconstitutional. INTERESTING! I wonder what kinds of lawsuits we will see that come out of these new Internet of Things...
ReplyDelete*https://law.justia.com/constitution/us/amendment-04/21-plain-view.html
In my world, the 4th amendment revolves around contractual obligations I have with residents that live in the residence halls. When a member of my staff smells the odor of marijuana, if they can reasonably identify where it is coming from, we call the police to assist. When the police arrive, they knock on the door while identifying who they are “POLICE OPEN UP,” and request entry. If the resident opens the door and the puff of marijuana smoke hits the officer in the face, there is probable cause to enter the room. This also allows my staff member to enter the space since it is in the housing contract, “When the door is open and a violation of Student Conduct Codes and/or University polices is in plain view.”
ReplyDeleteHere is where the interesting part comes in, if police knock on the door and instead of the door opening, we hear people inside the room shuffling around, the toilet flushing multiple times, windows being opened, etc… a decision has to be made. If my staff member was to take out their master key to open the door, we have to be extremely clear that we are not “agents of the law” since the criminal side of the incident is gone. There would still be student conduct present, I employee 17 conduct officers, but even then this is someone’s home. Unless my staff member feels that keying into the room is, “For the protection of health and safety or for emergencies,” I train them to put the master key away and continue to knock further. If the door is never opened, they can still document what they smelled, what they heard, and any other details for a conduct hearing.
This takes me back to the mischievous ferret. I think the officer(s) would be entering the private domical based on an emergency and therefore the marijuana would fall directly into “unreasonable searches and seizures,” from the 4th amendment. The officer(s) could accidently step on the alarming watch, back out of the space, and obtain a search warrant based on the probable cause they just observed. I am not sure they would want to go that far, I guess that would be up to the officer and the amount of marijuana that is sitting on the kitchen table/on the counter top/around the living room too.
Great post and comments everyone. It is obvious that privacy and the Fourth Amendment is a topic of high interest with everyone. We will address some aspects of these issues in class tomorrow.
ReplyDelete