It Could Happen Here Weekly 241

**Robert Evans** (0:03)
Hey, everybody, Robert Evans here, and I wanted to let you know, this is a compilation episode. So every episode of the week that just happened is here in one convenient and with somewhat less ads package for you to listen to in a long stretch if you want. If you've been listening to the episodes every day this week, there's going to be nothing new here for you, but you can make your own decisions.

**Garrison Davis** (0:28)
Welcome to It Could Happen Here, a show that is sometimes about surveillance, digital privacy and all the ways that little black rectangle you keep in your pocket could be used against you. I'm Garrison Davis. Today I am joined by Cooper Quinton, a security researcher and senior public interest technologist at the EFF or the Electronic Frontier Foundation.
Cooper, hello.

**Cooper Quinton** (0:52)
Hey, Garrison. Happy to be here again.

**Garrison Davis** (0:54)
Yes. Always happy to have you on. And you will be especially useful today because we're going to be talking about geofencing because last week the Supreme Court ruled that geofencing qualifies as a search under the Fourth Amendment. Now, before we get into what that means and why it's important.

**Cooper Quinton** (1:11)
All very normal terms that everybody will implicitly understand.

**Garrison Davis** (1:15)
Before we do that, let's start to define some of our terms here. Starting off with what is geofencing?

**Cooper Quinton** (1:23)
Yeah. So, geofence warrants, which are what this case is about, are warrants to a tech company, usually Google, that say, give us all of the identity account IDs that had phones in this set of geographic coordinates at this time period. So, if they send that to Google, Google sends back a list of all of the accounts they know of, usually anonymized at first, but that were in that geographic square from time A to time B, which is actually not something that Google does anymore. They've recently taken steps to no longer technically be able to respond to these warrants, which is a rare W for Google, but that is a geofence warrant. That's what's at the heart of that.

**Garrison Davis** (2:13)
Yeah, and the goal is essentially to identify what phones and by extension, which people were present around the time a crime was committed to narrow down a suspect from a very large pool of just random people in an area.

**Cooper Quinton** (2:29)
Yes, exactly. So there's a couple of ways you can think about this. If there is a protest and you want us to know the identities of all the protesters, you could get a geofence warrant for the area of that protest for the time of the protest. Or if there was a bank robbery, which happens here, you get a geofence warrant for two locations you think the bank robber might have been in, and then you are able to narrow it down from the which identities show up in both places.
That's your list of primary suspects.

**Garrison Davis** (3:03)
The reason why we're talking about this today is because on Monday, June 29th, in a 6-3 ruling, the Supreme Court found that police getting access to location data through a geofence does constitute a quote unquote search under the Fourth Amendment. And this finding could have really big impacts on digital privacy rights. The fact that geofencing is a Fourth Amendment search means that the practice of geofencing is subject to Fourth Amendment restrictions and protections.
Now, there's also been some people, I think, maybe exaggerating certain aspects of this ruling, because the court did not rule that geofence warrants are themselves unreasonable, just like in general. That's right. That question is still going to be determined by the Fourth Circuit. But what the court did find here also should not be minimized. It also is pretty significant to quote from the majority, quote, an individual has a reasonable expectation of privacy in records about his cell phone's location and police intrude on that constitutionally protected interest when they demand the information, even though for only a limited time and from a third party tech company.
We will get into some of what that's referencing in terms of third party tech companies later.
As you mentioned, this case does revolve around a bank robbery. And I want to get into some of the context of this because it also will help understand sort of the ongoing case regarding the specific geofence warrant that was used. So in 2019, someone made off with almost $200,000 from a credit union and the suspect was seen on their phone prior to the robbery. So police asked Google to hand over the location data for all cell phones or the devices in a 150 meter radius around the bank within an hour of that robbery. Nineteen anonymous users were first identified. Police then narrowed that down to nine users who they got more information from. From Google, they tracked the location for a longer period of time before police then requested personally identifying information on three users which they then used to arrest the suspect. So, the suspect eventually pleaded guilty, but it was like a conditional plea, because they were still challenging the evidence that was obtained through the geofence warrant citing a Fourth Amendment violation. That's right. Arguing that the warrant authorizing the location data search was invalid. And this claim made its way through the district court to the appeals court to the Supreme Court and we'll get into that in a bit. You already laid out some of the details of the specific geofence warrant that was used. It has this three-step process of first this big pool, then a smaller pool and then personal identifying information on the smallest pool. One thing that is really interesting to me is that the process for setting up this warrant was set up with the help of Google. They worked together to make this process back when this was still an emerging investigative avenue like five, six, seven years ago.