by Anthony W. Accurso

The Fourth Amendment to the U.S. Constitution guarantees “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures” and requires that warrants be issued only “upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the person or things to be seized.”

This language was crafted in response to general warrants issued in pre-revolutionary American colonies which allowed officers to conduct a “general, exploratory rummaging” through the homes and businesses of any person remotely suspected of criminal activity. Coolidge v. New Hampshire, 403 U.S. 443 (1971). While such warrants were not strictly legal under English law, the structures of judicial oversight were often rigged against the colonists.

Sometimes known as “writs of assistance,” these warrants were “widely used by British officials to search colonists’ imported goods to ensure compliance with the tax code.” In an 1817 letter, Founding Father and future President John Adams referred to a speech (which condemned such abuses) given by James Otis, a young lawyer from Boston, as “the birth of America’s struggle for independence.”

The wording of the Fourth Amendment with respect to warrants has been interpreted since the founding to have two primary requirements: (1) a showing of probable cause and (2) sufficient particularity in relation to that showing.

Probable cause is proof that a crime has been committed. This bar prevents officials from seizing and searching just any persons to discover whether a crime has been committed.

Particularity requires a limitation as to the places or persons to be searched, and it is to prevent leaving to the discretion of executing officials the decision as to which persons should be arrested and which places should be searched. This requirement is always perceived in relation to the showing of probable cause such that the places searched or seized have to do with the crime in question.

Search warrants alleged that there is a “fair probability” that evidence of a crime will be located in a particular location. This is often direct evidence but can also include witnesses. Such a warrant, when issued, allows a law enforcement officer to search an area otherwise deemed private and protected by the Fourth Amendment. However, because officers need no warrant when evidence of a crime is readily apparent, a large portion of case law is devoted to determining when a search actually occurs.

In the past, “the greatest protections of privacy were neither constitutional nor statutory, but practical,” because technological limitations made certain types of intrusion and surveillance either impossible, difficult, or prohibitively expensive. United States v. Jones, 565 U.S. 400 (2012). Yet an 1890 law review article published by Samuel Warren and Lewis Brandeis warned that “recent inventions … call attention to the next step which must be taken for the protection of the person” and that “numerous mechanical devices threaten to make good the prediction that ‘what is whispered in the closet shall be proclaimed from the house tops.’”

And those inventions did come. First the telephone, followed shortly by the wiretap and pen registers. The facility with which computers handled digital records led to enormous amounts of data about customers kept for ever-longer periods – an enticing source of evidence for law enforcement. Eventually, global positioning systems and smartphones would introduce a whole host of constitutional questions.

These technologies were employed by citizens in the course of ordinary life but also by police to catch criminals. Many of these attempts were eventually brought before the Supreme Court of the United States (“SCOTUS”) for adjudication on the issue of when a search occurs, thus necessitating a warrant.

In 1928, SCOTUS considered a case brought by one of several convicted bootleggers whose criminal case was, at least in part, based on evidence obtained from wiretaps. SCOTUS upheld a lower court’s denial of the defendant’s suppression motion with Chief Justice Taft writing, “There was no searching. There was no seizure. The evidence was secured by the use of the sense of hearing and that only. There was no entry of the houses or offices of the defendants.” Olmstead v. United States, 277 U.S. 438 (1928).

This ruling was so broadly unpopular that Congress passed Section 605 of the Communications Act of 1934 at least partly in response. This law was eventually deemed ineffective because it did not prevent wiretaps per se, allowing law enforcement to “wiretap freely so long as it did not seek to use the product as evidence at trial.”

Olmstead’s literal interpretation of the Fourth Amendment was overturned in 1967 in another case concerning wiretaps. Katz v. United States, 389 U.S. 347 (1967). SCOTUS suppressed evidence obtained when police used a wiretap on a public phone booth used by Katz. Justice Stewart famously described the Court’s shift in reasoning by writing, “the Fourth Amendment protects people, not places.”

It was Justice Harlan’s concurrence in Katz which announced a two-part test for determining whether a search had occurred. He wrote: “first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as ‘reasonable.’”

The negative corollary to the Court’s reasoning in Katz produced the third-party doctrine, “which asserts that disclosure of private facts to a third party constitutes forfeiture of reasonable expectation of privacy.” This rule has seen frequent use since its inception in United States v. Miller, 425 U.S. 435 (1976), in which SCOTUS held no warrant was required to obtain a defendant’s financial records from his bank. Consequently, law enforcement need only issue a subpoena or request to a company to obtain business records, even those regarding a customer.

A further distinction was drawn between “content” and “metadata” in Smith v. Maryland, 442 U.S. 735 (1979), when SCOTUS authorized use of a pen register, “for pen registers do not acquire the contents of communications,” they merely make a record of the numbers dialed from a defendant’s phone.

The Electronic Communications Privacy Act of 1986 statutorily codified these rules but also included electronic communications data “in transit, and when they are stored on computers.”

The most significant and recent shift away from the third-party doctrine came from the SCOTUS’ ruling in Carpenter v. United States, 138 S. Ct. 2206 (2018). Law enforcement sought “tower dumps” – metadata stored by cellular companies which include location data – for the purpose of tracking the movements of Timothy Carpenter over a 127-day period. The lower courts denied Carpenter’s suppression motion, ruling the data was “business records” maintained by the carrier which did not require a warrant. SCOTUS reversed, citing the “novel circumstance” of being able to retroactively track a person’s movements over such a period of time, deeming this a significant invasion of privacy.

Although though Carpenter seemed to contradict or limit the third-party doctrine, it was in keeping with the Court’s ruling in United States v. Jones, 565 U.S. 400 (2012). In Jones, the Court held that “the government’s installation of a GPS device on a target’s vehicle, and its use of that device to monitor the vehicle’s movements [over a four-week period], constitutes a search under the Fourth Amendment.”

Justice Scalia wrote in Jones, “GPS monitoring generates a precise, comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations,” and that “[t]he government can store such records and efficiently mine them for information years into the future.”

However, the Court expressly stated that Carpenter was a narrow ruling, which has been interpreted in two very different ways. Privacy advocates see it as requiring a warrant to obtain business records if those records contain location data; whereas, law enforcement has taken it to mean that a warrant is required for tower dumps only.

For instance, Criminal Legal News has reported that, despite harsh criticism, the Department of Homeland Security and other federal agencies have purchased location data from app data brokers with the intent of investigating crimes such as tax evasion, drug smuggling, and illegal border crossings.

Google’s Location History

Google stands out as one of the most visibly successful tech companies of the modern era. It began as an internet search provider but has greatly expanded its product offerings. Its Android operating system “controls around eighty-five% of the global smartphone market,” though only “46.8% of … U.S. smartphones.” Even on Apple smartphones, which comprise most of the remaining smartphone market in the U.S., people use Google products such as Search, Mail, and Maps. “[F]or the over 220 million estimated U.S. Mobile search users, 96% of searches were conducted via Google as of the first quarter of 2020.”

Despite many of its products ostensibly being offered for free to people all over the world, Google is extremely profitable, and the largest share of its earnings comes from advertising. The company has become infamous for the amount of data that it obtains from even casual users of its products, all in the name of providing “tailored ads” to customers.

This customer data is perceived as a vast library of records which can be obtained by police to investigate crimes. “From January to June 2020, for example, Google received – from domestic law enforcement alone – 15,588 preservation requests, 19,783 search warrants, and 15,537 subpoenas, eighty-three percent of which resulted in disclosure of user information.”

“Google is increasingly the cornerstone of American policing,” observed Albert Fox Cahn, a lawyer and executive director of the Surveillance Technology Oversight Project.

Among Google’s portfolio of products is its Maps application. It was launched in 2009 to help customers locate businesses and get directions. As of 2018, “sixty-seven percent of smartphone users who use navigation apps prefer Google maps.” The next most popular navigation app is Waze, which was purchased by Google in 2013.

In time, Google perceived value in not only providing directions but also in tracking the physical locations of its users. This allows for precision location-based advertising. For example, while using a navigation product in a particular area, a user will receive targeted ads from businesses physically near their reported location. Google can also correlate user location and business info to assess “conversion rates.” If Google shows an ad for a nearby business to a customer, and then observes the customer entering the business, it can use such data to impress other businesses with the efficiency and success of its advertising model.

Because of its usefulness, Google attempts to locate a user in physical space anytime the person accesses one of its products, even simple internet searches. When GPS is enabled on the device and made accessible to the app, the accuracy can pinpoint a user within a few feet. “In some instances, Google’s estimation of a device’s location may include an estimate of where a device is in terms of elevation. For example [Google] has the capability to determine if a user is on the second floor of a mall.”

According to court testimony by Marlo McGriff, a Google employee, “if a user opens Google Maps and looks at the blue dot indicating Google’s estimate of his or her location, Google’s goal is that there will be an estimated 68% chance that the user is actually within the shaded circle surrounding the blue dot.”

The “blue dot” is also referred to as the “Maps Display Radius.” This confidence rating can vary widely based on the sensor Google is using to estimate a user’s location. While GPS is an obvious source of data, even when GPS isn’t available, Google can attempt to locate a device from its nearness to cell phone towers (cell-site location information or “CSLI”). Android phones also, by default, constantly scan for Wi-Fi and Bluetooth signals. These can also be used to determine the location when compared to known data. For instance, a user might disable GPS, but when they drive past a Wi-Fi hotspot at a McDonald’s, Google can infer their location.

Further Google attempts to track users in near real time. According to court testimony by Spencer McInvaille, a forensic expert, “geolocation data is routinely collected from those sensors at certain intervals, about every two minutes, but the intervals can fluctuate.”

Google stores these signals in a database known as Sensorvault, tracking access to its products from billions of devices from all over the globe.

According to Google, a person who registers for an account can control whether this location data is retained for a specific period of time. This is through a lesser-known product called “Location History.” Google ostensibly provides this service so users can “keep track of locations they have visited while in possession of their mobile device. For example, a user can observe their visit to a ski resort and their travel to that ski resort from their hotel.”

Though Location History must be intentionally enabled by a user, it is one of the default options presented to a person who is configuring a new Android smartphone. According to court testimony by Emily Mosley, another Google employee, approximately “one-third of all active Google users had location history enabled on their accounts,” such that in “October 2018, there were approximately 592 million daily active users of Location History worldwide.”

Google and Geofence Warrants

The information stored in Sensorvault is exactly the kind of surveillance data that the government desires when it seeks to identify a suspect.

“The government wants haystacks. It firmly believes it can find needles,” wrote Tim Cushing for TechDirt.

Beginning in 2016, some creative and enterprising police officers begin asking Google for this information. Because this data was perceived as “business records” stored by a third party, these initial requests were unofficial requests or subpoenas for all the user data associated with any device that was present within some arbitrary number of meters of the location a crime was committed, further narrowed by an arbitrary time during which police suspected the crime took place.

This is how geofence warrants got their name, from the invisible fence erected around a geographical space inside which users may be identified. They are also referred to as “reverse location search warrants” in that, instead of identifying a known suspect and seeking to search that suspect’s property, reverse location warrants first seek to identify the suspect from a suspected location.

During that first year, Google received fewer than 100 requests. The process has evolved significantly in the intervening years due to its popularity as a law enforcement tool, and it isn’t difficult to understand why.

Imagine someone is shot in a nightclub. Also imagine that, before the shooter or any potential witnesses are allowed to flee the scene, police are able to cordon off the area and interview people about their movements when the shooting occurred and even throughout the proceeding 24 hours. Officers would have a reasonable expectation that they would be able to identify the shooter, not necessarily by finding a firearm on a particular person, but by gathering enough information to make a reasonable determination. Imagine also that when doing this, they had other indexed information available such as prior criminal histories, gang association data, and whether someone present was on probation or supervision.

Having a magical device which transported officers to the scene to accomplish this detective work would be invaluable. Even more so if they could be transported to the scene of the crime even if several days or months had passed.

The Location History data in Sensorvault, in many ways, allows police to do just this. They can determine who was nearby when a crime was committed, even after a significant amount of time has passed. They can track the movements of those persons of interest back to their homes or jobs and interview them. Importantly, this location data can be correlated against other databases in the possession of law enforcement, in an investigative strategy known as “fusion.”

With enough historical data, police can in theory solve almost any crime, for murders on down to petty theft. And previously, where officers would have to do a significant amount of legwork to identify and then investigate a suspect, police can now instead use location history information to get a wealth of data on anyone near where a crime was committed.

This new tool by police to identify suspects and witnesses proves so useful that police from all over the country are going to Google to get data. What began as a trickle of requests in 2016 has become a veritable Niagara Falls of requests. And while Google has worked with police to fulfill lawful requests, it has adopted several legal positions and policies since 2016 to manage this process.

Google has decided that only Location History data “is responsive to a geofence search warrant, as it is the only location data that is associated with a Google account with sufficient precision.” Thus, the company has so far refused to fork over location data it collects on casual users of its products.

Google has also decided that Location History information is the private property of its users. Since the company consulted with the Department of Justice’s Computer Crime and Intellectual Property Section (“CCIPS”), it now requires that all requests for Location History data must be in the form of a court issued warrant.

Google also began charging $245 per request in 2020 pursuant to federal law, which allows private entities to offset the costs of complying with warrants and subpoenas by charging police.

This fee was also seen as an effort to stem the tide of requests. “Tallies have continued to grow, however, and Google received an average of more than 30 geofence warrants per day in 2020,” according to an article in the Stanford Law Review. Haley Amster & Brett Diehl, “Against Geofences,” Stanford Law Review, vol. 74, Feb. 2022. The most recent count was that Google received 11,554 geofence warrants in 2020, up from 8,396 in 2019 and 982 in 2018.

Finally, also in coordination with CCIPS, Google has required all warrants it receives to comply with its guidelines, which define three steps for each request. Under threat of non-compliance and a costly court battle, police have largely complied with these guidelines.

According to the National Association of Criminal Defense Lawyers (“NACDL”), the “geofence process involves up to three steps, which may be completed through a single or multiple warrants or through a combination of warrants and other forms of process.” This means that each step may comprise a single warrant, be separated into three warrants, or some hybrid including a subpoena only for unmasking.

Step One (“the dump”) is where “the government first seeks anonymized numerical identifiers [device IDs] and time stamped location coordinates for every device that passed through an area in a specified window of time,” according to the NACDL.

The result is a spreadsheet with the following details for each “hit”: device ID, date, time, latitude, longitude, source (i.e., GPS, Wi-Fi, or CSLI), and Maps Display Radius (in meters).

Step Two (“selective expansion”) requires the police to choose some subset of the devices identified in Step 1 for which they can obtain location information from outside the initial time window. This is accomplished by correlating other known evidence with the data from Step One. For instance, if robbery suspects were seen fleeing in a vehicle, the police would focus on device IDs that left the area at the speed of a vehicle in the reported direction. Google would then provide information about where a suspect’s vehicle traveled before and after the crime was committed – a suspect’s home perhaps.

Step Three (“unmasking”) involves police requesting user account details on device IDs of interest remaining after expansion from Step Two. This includes all identifying information on the user such as full name, birthdate, phone number, and even recovery email addresses.

Google Warrants and the Courts 

Criminal Legal News readers may, at this point, wonder if other tech companies collect location data about their users and whether police have attempted to obtain this data. According to the Harvard Law Review, though “Apple, Lyft, Snapchat, and Uber have all received these warrants, Google is the most common recipient and the only one known to respond.” “Geofence Warrants and the Fourth Amendment,” Harvard Law Review, May 2021 (“HLR Article”).

Large tech companies have vastly more resources than most law enforcement agencies or their parent jurisdictions, with the possible exception of the federal government. That the companies have been unwilling to release user location data and have been allowed to maintain this position without significant litigation speaks to a variety of factors. Of course, it may simply be that Google has more users, more data, and more precision than any other company and is willing to release it to police. This may be why, in large part, Google has been able to dictate the terms under which it releases the data, for better or worse.

Requiring police to obtain a warrant has had the effect of normalizing the idea that obtaining this data is in fact a “search” under the Fourth Amendment. The warrant requirement, until recently, has proven no great barrier to obtaining data. Despite the fact Google has processed approximately 25,000 geofence warrants since it began doing so in 2016, very few appear to have been denied by magistrate judges or even subjected to any kind of serious scrutiny.

“Additionally, geofence warrants are usually sealed by judges,” according to the HLR Article, though there seems to be no requirement for doing so. “In fact, geofence warrants, like most warrants, are almost certainly ‘judicial records,’ which ‘are the quintessential business of the public’s institutions’ and should, by default, be available to ensure ‘the transparency of the Court’s decision making process.’”

Ideally, judges who issue warrants are “neutral and detached” whose decisions regarding issuance are “informed and deliberate.” United States v. Lefkowitz, 285 U.S. 452 (1932). But judges do not always understand the technology involved or its implications when considering criminal investigations. See the statement of Kennedy, J., during oral argument in the case of City of Ontario v. Quon, 560 U.S. 746 (2010), “asking whether, if you are trying to text somebody who is simultaneously texting someone else, you will get a voicemail saying that your call is very important to us; we’ll get back to you.”

Reporting by Tim Cushing of TechDirt in February 2019 showed that Minnesota police submitted warrants that “contain GPS coordinates but no map of the area covered,” such that the “warrants likely don’t give judges any idea how many people will be swept up in these data requests.” Cushing also wrote that, of “the 22 reverse location search warrants issued in Hennepin County, only three times did the warrant applications include [a] map demonstrating the geographic area being targeted by the warrant. And yet, the time difference between an officer signing a warrant request, and a judge approving it, was sometimes just a few minutes.”

One of the first and most widely publicized rebukes of geofence warrants came from the United States District Court for the Northern District of Illinois, in which police sought a geofence warrant to investigate “the theft and resale of certain pharmaceuticals.” In re Search of Info. Stored at Premises Controlled by Google, 481 F. Supp. 3d 730 (N.D. Ill. 2020). Of the three geofences requested, one “covered a 100-meter radius (over 7.7 acres of land) during the afternoon in a densely populated area containing restaurants, various commercial establishments, and at least one large residential complex.” The other two covered an area including “medical offices and other single and multi-floor commercial establishments that are likely to have multiple patrons.”

The reviewing Magistrate Judge, M. David Weisman, acknowledged that the suspect’s phone data would likely be included in the data but that the requested search was overbroad. Weisman wrote that it “strains credibility” to believe that individuals within the entire geofence either participated in, or bore witness to, the exchange of a mail package inside a business. To do so, potential witnesses would need to “possess extremely keen eyesight and perhaps x-ray vision to see through … many walls.”

Weisman explained that the Government’s request was insufficiently narrowed with regards to the crime scene. The “geographic scope of this request is a congested urban area encompassing individuals’ residences, businesses, and healthcare providers,” such that the “vast majority of cellular telephones likely to be identified in this geofence will have nothing whatsoever to do with the offenses under investigation.” He summarized by saying, “the warrant does not limit agents to only seeking identifying information as to the ‘five phones located closest to the center point of the geofence,’ or some similar objective measure of particularity.”

As more courts write unsealed opinions about geofence warrants, Weisman’s assessment and rejection would signal a theme. First, courts have agreed with Google’s assessment that geofence warrants are a “search” covered by the Fourth Amendment and, second, that the geofenced area must be sufficiently narrow in place and time such that most of the devices identified would belong to either suspects or likely witnesses. Or, in the words of the courts, that the search occasioned by such a warrant must be sufficiently particularized.

The officers investigating the pharmaceutical theft and sale would go on to try two more warrants in the Northern District of Illinois, only to be rejected both times.

In rejecting the second warrant application, Magistrate Judge Gabriel Fuentes noted that, though the government requested somewhat smaller geofenced areas, “the Court still has no idea how many devices and their users will be identified under the warrant’s authority.”

The third warrant requested was also reviewed by Fuentes. This request did not include an unmasking step, and the Government limited “the anonymized information [sought] to that which identifies individuals who committed or witnessed the offense.” Fuentes found these alterations also failed constitutional muster. He correctly assessed that the unmasking step performed by Google was unnecessary for police because they already had a wealth of other surveillance data on citizens such that they would likely attempt to “accomplish indirectly what it may not do directly.”

His criticism of the instruction for Google to return device IDs belonging to only suspects or witnesses noted that police provided no “further methodology or protocol” explaining “how Google would know which of these sought after anonymized information identifies suspects or witnesses.”

In June 2021, District of Kansas Magistrate Judge Angel Mitchell denied a geofence warrant regarding an unspecified crime. In re Search of Info. That is Stored at the Premises Controlled by Google, LLC, 542 F. Supp. 3d 1153 (D. Kan. 2021). The geofence there encompassed “two public streets, that the subject building contains another business, and that the area just outside of the perimeter … includes residences and other businesses.” She wrote that the results of the search “would undoubtedly show” where certain devices were during the time requested, including the suspects, but the Government’s statements were “too vague and generic to establish a fair probability – or any probability – that the identity of the perpetrator or witnesses would be encompassed within the search.”

She was also concerned with how the Maps Display Radius functions, writing that the Government failed to “explain the extent to which the geofence, combined with the margin of error, is likely to capture uninvolved individuals from … surrounding properties.”

While these four warrants were denied for lack of probable cause and particularity due to the geofences potentially sweeping up too many uninvolved persons, at least one notable approval occurred in a U.S. District Court.

Magistrate Judge Sunil Harjani – also from the Northern District of Illinois – approved a geofence warrant in 2020 in relation to a series of approximately 10 arsons in the Chicago area. In re the Search Warrant Application for Geofence Location Data Stored at Google Concerning an Arson Investigation, 497 F. Supp. 3d 345 (N.D. Ill. 2020). However, the geofence was very carefully crafted to obtain information on devices belonging to suspects or witnesses. 

A summary in the Stanford Law Review stated: “The government requested six geofences, four located in commercial lots where the vehicle fires had occurred and two along areas of roadway where the unknown arsonists were alleged to have traveled. Each spanned between fifteen and thirty-seven minutes in length during early morning hours. All but one covered less than a city block, with the fourth proposed geofence covering an elongated roadway area approximately the length of 1.25 city blocks.”

Harjani noted that the warrant request was appropriately narrow because the buildings and streets contained in the geofences were unlikely to be occupied during the early morning hours requested, and thus, the warrant was “narrowly crafted to ensure that location data, with a fair probability, will capture evidence of the crime only.”

Despite these published opinions, it appears that the vast majority of geofence warrants are approved with very little comment or oversight. The gatekeeping function of the courts is not limited to magistrate judges however. Where individuals have been charged with a crime that was investigated in part using a geofence warrant, few so far have been challenged in the form of a suppression motion. [Editor’s note: Although the defendant’s motion to suppress was denied, anyone interested in this topic is encouraged to read United States v. Rhine, 2023 U.S. Dist. LEXIS 12308 (D.D.C. 2023), in which the Court provides an exceptionally thorough analysis and application of the current law governing geofence warrants.]

A notable ruling on a suppression motion came from the case of alleged bank robber Okello Chatrie, who was charged in September 2019 with robbing $195,000 from a bank in Midlothian, Virginia. United States v. Chatrie, 590 F. Supp. 3d 901 (E.D. Va. 2022). However, in this case, the geofence was very large.

“The area covered by the geofence was 78,000 square meters, or about 17 acres, but with the approximate margin of error added, the effective range was 470,000 square meters, or about 116 acres,” summarized a Stanford Law Review article. The geofence warrant covered a mixed residential commercial area alongside a busy regional highway. “In addition to the bank that was robbed, the geofence encompassed the entirety of a megachurch housed inside of a converted Costco superstore. Just outside of the geofenced region is a hotel with 68 guest rooms, the occupants of which would have been included in the Google returns if their maps display radii extended beyond a few yards.”

Law enforcement was particularly aggressive during the three-step process as well, repeatedly seeking data “for one hour on either side of the robbery … without geographic restriction” for all the devices contained in the initial dump. However, “Google did not comply until investigators identified a subset of nine users for further scrutiny.”

Remarking on the scope of the warrant, Judge M. Hannah Lauck wrote that the warrant “plainly violates the rights enshrined” in the Fourth Amendment because it “swept in unrestricted location data for private citizens who had no reason to incur government scrutiny.”

Though the warrant itself was deemed unconstitutional, the evidence obtained from it will still be used to prosecute Chatrie thanks to the Leon good faith exception. See United States v. Leon, 468 U.S. 897 (1984).

“Lauck ruled that the evidence could stand in this case, saying the detective who sought the warrant was not at fault because he had no one telling him it was unconstitutional; he had successfully sought geofence warrants in past cases and had consulted with prosecutors,” reported NBC News.   

 A similar outcome would have occurred in a California state case were it not for the foresight of that state’s legislators.  

LaQuan Dawes was charged with the burglary of a residence in San Francisco that was executed on October 24, 2018, and he filed a suppression motion for the geofence warrant used to identify him. People v. Dawes, No. 19002022 (Superior Ct. of Cal 2022) (Order Granting Motin to Quash Geofence Search Warrant).  

Honorable Linda Colfax of the Superior Court of California for the County of San Francisco made three significant points in her 59-page ruling, which granted the suppression motion.  

First, though all the federal courts had been relying on Fourth Amendment precedent to determine that obtaining location data from Google constitutes a search, Colfax noted that Cal. Penal Code § 1546.1(a)(1), a provision of California’s Electronic Communications Privacy Act (“CalECPA”), defines “electronic communication service” and that the location data stored by Google is such a service. Further, § 15461.1(a)(2) states that this data is “protected,” meaning that a search warrant is required by law to obtain it.  

The judge then found the warrant overbroad in two respects. The design of the geofenced area “not only included the burglarized residence [in addition to the entire street area in which the suspect vehicle traveled], but also five other private homes on the same block.” She continued, writing that the “geofence search warrant application affirmatively targeted location information of the innocent habitants and visitors of the neighboring residences along with the suspects.”  

She further took issue with the second step in Google’s process, in which it is left to police to determine which devices will be subject to additional scrutiny. “The discretion to select which devices for which Google must provide additional step to data should fall on the judiciary, not the executive,” wrote Colfax, “to ensure that the selection process comports to the Fourth Amendment’s reasonableness requirement.”  

Colfax’s final significant point related to the exclusion of the evidence obtained from the geofence warrant. She too found that the officer relied in good faith on the advice provided to him regarding such warrants, but this was insufficient under CalECPA. She ruled that, though the Lost text does not categorically exclude geofence warrants, “the Legislature deliberately chose not to incorporate a good faith exception into the statutory exclusion rule.” In making this decision, she referenced §§ 1546.4(a) and 1546.1(d)(1).  

Legal Criticisms

One of the main arguments made in criticizing geofence warrants is that they search an unknown number of persons that likely have nothing to do with the crime under investigation and, as such, constitute a general warrant similar to the writs of assistance that were used to harass early American colonists.  

An analysis in the HLR Article notes that “a general warrant is one that ‘specifies only an offense,’ leaving ‘to the discretion of executing officials the decision as to which persons should be arrested and which places should be searched.’” As with many divisive topics in America, whether geofence warrants involve the unfettered discretion of government agents to conduct a general rummaging depends on the details.  

One such detail is when the actual search occurs. Thus far, every court that has reviewed a geofence warrant has determined that the search occurs when Google provides location data to police at the end of Step One.   

But the HLR Article argues that the search occurs earlier than this. Google has told courts that, in order to produce data in Step One, it must compare every record and Sensorvault to the searched criteria. And, arguably, Google is acting as “a government agent” when it does so, because it is searching Sensorvault in response to legal compulsion and “with the participation or knowledge of a government official.” United States v. Jacobsen, 466 U.S. 109 (1984). The logical extension of this argument is that every person who uses Google’s location history is searched every time Google responds to any geofence warrant. This searching is even more broad than a CSLI tower dump.  

“The difference between a tower dump and step one of Google’s framework is obvious: the tower dump involves only data tied to the cell tower’s location, while Google searches all of its location data even though none of it may be within the parameters of a geofence warrant,” explains the HLR Article.   

If geofence warrants were to be assessed from this position, it is likely that none would pass constitutional muster, and accordingly, a strong argument could be made to support a legislative ban on this misuse of Google’s data.  

However, the HLR Article notes that the Supreme Court may choose to allow geofence warrants, even if the search is determined to occur at the beginning of Step One, because it involves an extremely limited intrusion into a person’s private space. The Supreme Court’s rulings in Jones and Carpenter both involved a significant period of time in which the suspect was under a kind of electronic surveillance.  

Knowing where an individual is at one point in time is much less intrusive than following them around for days or weeks, largely because the latter allows police to ascertain historically private details such as religious associations or sexual habits. Piecing together a picture of a person’s life using continuous surveillance or multiple types of surveillance in concert has been dubbed “mosaic theory.” According to Tim O’Brien, an ethical tech advocate at Microsoft, this is a means of identifying Fourth Amendment searches by “analyzing police actions over time as a collective ‘mosaic’ of surveillance,” and thus, a “mosaic can count as a collective Fourth Amendment search even though the individual steps taken in isolation do not.”   

Also, to be considered in this context is how such data, once obtained by police, contributes to the surveillance milieu of other data collected by police. Large metropolitan police departments such as the Chicago and Los Angeles police departments have been known to collect mountains of data from various sources such as gunshot detectors, automated license plate readers, public and private security cameras, and social media posts. The inclusion of historical location data must be viewed in this context.  

Even where the data released by Google is indexed by device ID and is never unmasked – some geofence warrants, especially when the three steps are separated into individual warrants for each step, do not involve an unmasking – this is no guarantee of anonymity.  

O’Brien notes that in “2013 researchers studied fifteen months of human mobility data for one and a half million individuals and found that even coarse-grained data that specifies a person’s location hourly was ‘enough to uniquely identify ninety-five percent of the individuals.’”   

Other allusions to the constitutionality of geofence warrants pointed to the Supreme Court’s ruling in Ybarra v. Illinois, 444 U.S. 85 (1979). Ventura Ybarra was a patron of the Aurora Tap Tavern who was searched when police were executing a warrant that authorized the search of the tavern and the bartender for evidence of heroin distribution. In searching the “tavern,” police conducted physical searches of all the bar’s patrons, during which they found Ybarra in possession of heroin.  

The Court noted that “the agents knew nothing in particular about Ybarra, except that he was present, along with several other customers, and a public tavern at a time when the police had reason to believe that the bartender would have heroin for sale.” In suppressing evidence of the search, the Court instructed that “a person’s mere propinquity to criminal activity does not, without more, give rise to probable cause to search that person.”  

But this case, which seems to disfavor geofence warrants at all, must be balanced against the Court’s ruling in Michigan Department of State Police v. Sitz, 496 U.S. 444 (1990), which held that drunk-driving checkpoints are not per se unconstitutional searches.  

The Court described the checkpoint process as follows: “All vehicles passing through a checkpoint would be stopped and their drivers briefly examined for signs of intoxication. In cases where a checkpoint officer detected signs of intoxication, the motorist would be directed to a location out of the traffic flow where an officer would check the motorist’s driver’s license and car registration and, if warranted, conduct further sobriety tests. Should the field tests and the officer’s observations suggest that the driver was intoxicated, an arrest would be made.”

Amster and Diehl, writing in the Stanford Law Review, argue that geofence warrants, including the selective expansion step, are similar to sobriety checkpoints such that “all individuals in the area are preliminarily inspected and, at the officer’s discretion, searched.”  

Yet another criticism is whether there ever is a fair probability that Google has information on a suspect or witnesses to a crime. Judge Colfax concluded there was a fair probability that the suspects were: (1) located inside the geofence during the specified period; (2) using their cell phones; (3) communicating location history to Google through the cell phones; and (4) traceable through the information stored in Google’s Sensorvault.  

This was based on “84% of Americans owning smartphones in 2018,” that there were “592 million daily active users of Location History worldwide and roughly one-third of those active users had Location History enabled on their accounts.”  

But this is a misunderstanding of the statistics that is at odds with Google’s claims. The number of active Location History users is 592 million, but that number is the worldwide figure. A more important number would be the number of active Location History users in the U.S. as compared to the general population. If Android users are just under half the adult population in the U.S., and only one third of Google users have Location History enabled, there’s only an approximately one-in-six chance that the data sought will be in Google’s database. Is that a fair probability?  

The last legal criticism of geofence warrants is more of a criticism of the justice system in general, and it is that the mechanisms of oversight are lacking where geofence warrants are concerned. Indeed, where the vast majority of such warrants are approved and Google rejects some portion as overbroad, the only effective check on police misuse appears to be corporate, not judicial.  

As mentioned before, the majority of geofence warrants are judicially sealed so that the public cannot inspect them. Hence, warrants are processed and approved without the knowledge of the users who are affected.  

“The thing about these abuses in these instances is they’re hidden,” remarked tech security expert Bruce Schneier. “If there’s an abuse, you’re not going to know because of parallel construction, which is the way data obtained illegally is washed and not used in court, but data obtained from that data is used.”   

“I’m sure it happens a lot where the NSA passes the FBI data,” Schneier said. “The NSA tells the FBI, ‘This thing is happening on a street corner,’ and the FBI just happens to have an officer there, and the NSA involvement is never mentioned. And, of course, if the FBI has this kind of data, they’re likely to use it for whatever they [want].”   

Police departments also seem reluctant to reveal that they are using geofence warrants. All law enforcement agencies in California are required by state law to disclose executed geofence warrants or requests for geofence information, accessible by the public through California’s OpenJustice dataset.  

“Between 2018 and 2020, [Google] said in a recent transparency report, it had received 3,655 geofence warrant requests from agencies operating in the state.” Yet a review by markup.org revealed that “of the state’s data between 2018 and 2020 found only 41 warrants that could clearly constitute a geofence warrant.”  

“When the providers are telling you one thing, and the government is telling you another, then something’s broken and it needs to be fixed,” said Albert Gidari, who previously served as consulting director of privacy at the Stanford Center for Internet and Society.  

In addition to blatant abuses which may go unnoticed, there is a more subtle issue at play: asymmetric expertise. Geofence warrants are a comparatively new tool and one with a complicated technological and legal underpinning. A great many magistrate judges and criminal defense attorneys have not heard about them or, if they have, don’t have the training to meaningfully understand the issues at stake.  

Law enforcement officers who use novel technology techniques are thus at a distinct advantage. Officers applying for warrants regularly attest to receiving specialized training in “digital forensics, cellular phone analysis and cellular technology” or “formal on the job training in cybercrime investigation techniques, computer evidence identification, and computer evidence seizure and processing,” according to O’Brien.  

Though judges are encouraged to obtain continuing education, most have no specific requirement to get training, especially in specialized areas of technology. Further, one of the largest providers of continuing education for judges, the National Judicial College, had no courses in its 2021 online catalog that mentioned the terms “geofence” or “reverse location.”  

Public defenders, who litigate the bulk of criminal cases in the U.S., are similarly at a disadvantage. “Public defenders are often the most overworked and underpaid lawyers in the criminal justice system, with little time and few resources to research the new technology now being used against their clients,” wrote Johana Bhyiyan, a reporter for The Guardian. “This, in turn, creates an uneven playing field that disadvantages the most vulnerable people: those who can’t afford private attorneys.”  

“Often for the folks who are most targeted by these tools and the criminal legal system, the only person standing between them and a jail cell is their public defender,” said Jumana Musa, the director for the Fourth Amendment center for the NACDL. Her group provides resources and, sometimes, litigation support to attorneys unfamiliar with new investigative tools. The litigation director for the Fourth Amendment Center, Mike Price, describes the situation as “playing Whac-A-Mole,” because even as the group identifies and learns about a new surveillance technology, the rapidity of development and police usage exceed their ability to keep pace.  

Our justice system is, in theory, supposed to safeguard the constitutional rights of all citizens, regardless of their ability to afford a lawyer. But this knowledge asymmetry further disrupts the standard adversarial process to heavily favor the government at a time in history where government already has the upper hand for numerous other reasons.  

Problems and Solutions

The criminal justice system in this country is already suffering the strain of having to support decades of mass incarceration, and the introduction of new tools like geofence warrants presents yet another strain on the system. The normal checks and balances on police abuses are alarmingly absent in with respect to geofence warrants, and the situation will become even more alarming if geofence warrants persist as a judiciary only problem. What’s needed is active intervention by politicians who are accountable to the public.  

Most people in the U.S. are unaware of the actual surveillance capabilities of law enforcement, and this includes geofence warrants. Despite warnings about government and corporate collection of data, approximately a third of Google account holders enable the Location History feature, despite most never using the “benefits” advertised by Google for doing so.  

When a crime is committed and police have no suspects, they will almost certainly go to Google with a geofence warrant. Whether or not the perpetrator had a smartphone that was reporting its location to Google, police are going to develop suspects from this pool of data exhibiting what is obviously an availability bias. This means that every person who uses the Location History feature has unknowingly entered themselves in a wrongful arrest (and possibility conviction) lottery.  

Take the case of Jorge Molina from Avondale, Arizona. Police arrested Molina in connection with a March 2018 murder after determining a device linked to his Google account was at the scene of the crime. He was told by a police interrogator that his phone “one hundred percent, without a doubt” placed him at the crime scene, and he spent six days in jail. Further, police told dozens of media outlets that he was the primary suspect, and he subsequently “dropped out of school, lost his job, car, and reputation, and still has nightmares about sitting alone in his jail cell,” according to the HLR Article.  

Further investigation found that Molina had lent an old phone – which was still tied to his Google account – to “Marcos Cruz-Gaeta, the ex-boyfriend of Molina’s mom,” so the investigation pivoted away from Molina. However, the damage to his life was already done.  

As outrageous as false arrests are, they are infrequent enough that they are unlikely to generate sufficient outrage for the public to demand change. A much more likely candidate will be when Google begins receiving warrants for data intended to prosecute politically divisive laws.  

Though abortion providers in states where it has effectively been criminalized will likely choose to simply close down or pivot to providing other family healthcare services, nothing prevents police in Texas from obtaining a geofence warrant for a facility in New Mexico at random intervals with the intention to link it back to a Texas resident.  

For the issue of abortion access, the issue of digital dragnets violating electronic privacy only begins with geofence warrants. It also branches out to other data stored with providers like Google.  

It is not farfetched to see warrants seeking data from companies that operate period-tracking apps. Given a large enough database, police are sure to find more than a few women who go a month or two without a period and then start up again. Should we trust that the anti-abortion police aren’t going to harass these women and maliciously interpret possible miscarriages?  

Similar to geofence warrants are keyword search warrants. These involve police requesting information from Google on anyone who searches for a particular term on Google’s main page. These have, most recently, been used to prosecute arsons, as arson suspects are believed to be interested in viewing news coverage about the fires they cause. But these could easily be wielded against women researching abortions or related services.  

“It is so chilling. It is so broad. It is contrary to our civil rights. And yet, because Google has so much of our data, it’s just a ticking time bomb for pregnant people,” said Albert Fox Cahn. “This is the equivalent of going to a library and trying to search every person who checked out a specific book. We would never allow that in an analog world.”   

In July 2022, Google announced it was “committed to deleting location data that shows when people go to abortion providers, fertility centers and other ‘particularly personal’ places,” and Google executive Jen Fitzpatrick wrote a blog post reminding users that they can manage Location History settings and remove history containing possibly sensitive information.  

Google employees, some led by Ashok Chandwaney, a software engineer and part of the Alphabet Worker’s Union, has criticized Google’s commitments. “They’re really looking for these short, punchy press releases that get this breathless, ‘Wow, Google is doing such good things,’ or ‘Alphabet is doing such good things,’ coverage in the tech media, but then aren’t actually substantial,” said Chandwaney. His group is pushing to “make it so that the data that could get people charged, or fined, or thrown in jail, or whatever for seeking out health care is not a thing that the company has to give to law enforcement.”   

Genuine solutions are going to have to come from legislatures. The courts are going to allow geofence warrants and other broad intrusions into cloud storage data, and police departments have shown they cannot be trusted to not abuse their surveillance capabilities.  

“The laws have to be changed,” said Bruce Schneier. “There’s no magic thing you can do on your phone to protect it. These are systemic problems that need systemic solutions. So, make this a political issue.”  

CalECPA was a good start, because it at least provides for evidence suppression when warrants, geofence ones or otherwise, are constitutionally infirm. Assemblywoman Mia Bonta, D-Oakland, has introduced Assembly Bill 793, a bill to ban both geofence and keyword search warrants. It would modify CalECPA to totally reject such warrants instead of only overbroad requests by police. Similar legislation is also under consideration in New York state. And while these bills are a good start, we need to start seriously thinking forward about technology and privacy.  

The NACDL’s Mike Price said, you “have to imagine companies like Google know that if they collect [the data], [law enforcement] will come.” Price’s description of the dance between new surveillance tech subsidized by corporate giants and constitutional privacy protections as “Whac-A-Mole” will continue to be the status quo until we, as a society, decide that nobody –  corporations or governments or whoever – should be able to collect and retain the amount of private information about people that Google and other tech companies have been doing.  

An argument can be made that Google needs such data to effectively sell ads, but that efficiency is not significantly diminished when Google is unable to retain that data. The European Union’s General Data Protection Regulation has done an adequate job at preventing companies from collecting user data, and it has provided for economic incentives that have shifted some of the power toward user control of data. The U.S., home to many of these tech companies, should be able to do better.  

Without thoughtful, proactive legislation governing the entirety of the U.S., geofence warrants will only be the tip of the coming iceberg of dystopian, tech-enabled intrusions into the private lives of people, with many more and even more shocking intrusions to follow.  

Sources: Orin S. Kerr, “Geofence Warrants and the Fourth Amendment” (2021); Electronic Frontier Foundation, “Geofence Warrants and Reverse Keyword Warrants Are So Invasive, Even Big Tech Wants to Ban Them” (2022); National Association of Criminal Defense Lawyers, “Geofence Warrant Primer” (2022); Amster, Haley, and Brett Diehl, “Against Geofences” (2022); McBrien, Tom, and Joseph Jerome, “ACLU, public defenders push back against Google giving police your mobile data” (2017); Google Transparency Report, “Global requests for user information” (2023); The Guardian (2023); Libertas Institute, “Geofence ‘Warrants’: An Unconstitutional Abuse of Technology”, (2023); Kanik, Zafer, “Fragility, Rescues, and Stability in Financial Networks” (2021); Electronic Frontier Foundation, “California Court Suppresses Evidence from Overbroad Geofence Warrant” (2022); Varner, Maddy and Alfred Ng, “Thousands of Geofence Warrants Appear to be Missing from a California DOJ Transparency Database” (2021); Johnson, Carrie and Marisa Kwiatkowski, “Google Data Shows Sharp Rise in Abortion Prosecutions” (2022); Capitol Weekly, “Bonta bill would bar ‘geofence’ warrants” (2023); NBC News, “Geofence Warrants Help Police Find Suspects Using Google. A Ruling Could Curb Their Use” (2022); 12news.com (2023); techdirt.com; MSNBC, “Geofence Search Warrants in the Jan. 6 Investigation” (2023).