Credit: Thinkstock If you have your cellphone on you, then it constantly pings against the closest tower, whether you are using it or not. Cops and the government regularly use that cellphone location data without a warrant. But in Florida, Georgia, and Alabama, tapping into that location data without a warrant is now illegal.“We hold that cell site location information is within the subscriber’s reasonable expectation of privacy,” a three-judge panel of the 11th U.S. Circuit Court of Appeals in Florida recently decided (pdf). “The obtaining of that data without a warrant is a Fourth Amendment violation.”The case involves the conviction of Quartavious Davis for armed robberies in Miami, a conviction based on cellphone location data that the government obtained from a wireless carrier without a warrant. Instead of proving probable cause for a warrant, the Miami U.S. Attorney got a “D-order” for location data deemed “relevant and material” to an investigation. In fact, the cops got 11,606 location records for Davis, which averaged out to about 173 points per day. That’s just crazy – over-the-top tracking – and although the conviction held, as did Davis’s 162-year sentence, the court put its foot down in a big privacy win.Judge David Sentelle wrote (pdf): The United States further argues that cell site location information is less protected than GPS data because it is less precise. We are not sure why this should be significant. We do not doubt that there may be a difference in precision, but that is not to say that the difference in precision has constitutional significance. While it is perhaps possible that information could be sufficiently vague as to escape the zone of reasonable expectation of privacy, that does not appear to be the case here.The prosecutor at trial stressed how the cellphone use of the defendant established that he was near each of six crime scenes. While committing a crime is certainly not within a legitimate expectation of privacy, if the cell site location data could place him near those scenes, it could place him near any other scene. There is a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship, or a house of ill repute. Again, we do not see the factual distinction as taking Davis’s location outside his expectation of privacy. That information obtained by an invasion of privacy may not be entirely precise does not change the calculus as to whether obtaining it was in fact an invasion of privacy.“The court’s opinion is a resounding defense of the Fourth Amendment’s continuing vitality in the digital age,” ACLU attorney Nathan Freed Wessler said. “This opinion puts police on notice that when they want to enlist people’s cellphones as tracking devices, they must get a warrant from a judge based on probable cause. The court soundly repudiates the government’s argument that by merely using a cellphone, people somehow surrender their privacy rights.”Additionally, the government has argued that the NSA’s warrantless metadata collection program is legal because customers’ phone records are business records and therefore not private. The Eleventh Circuit opinion may help prove that NSA metadata collection does violate peoples’ expectation of privacy, despite customers’ records also being business records. The ruling, according to Jennifer Granick, civil liberties director at the Stanford Center for Internet and Society, “has taken a giant step away from the legal justification propping up many of the government’s targeted and bulk metadata collection practices.” Related content news Dow Jones watchlist of high-risk businesses, people found on unsecured database A Dow Jones watchlist of 2.4 million at-risk businesses, politicians, and individuals was left unprotected on public cloud server. By Ms. Smith Feb 28, 2019 4 mins Data Breach Hacking Security news Ransomware attacks hit Florida ISP, Australian cardiology group Ransomware attacks might be on the decline, but that doesn't mean we don't have new victims. A Florida ISP and an Australian cardiology group were hit recently. By Ms. Smith Feb 27, 2019 4 mins Ransomware Security news Bare-metal cloud servers vulnerable to Cloudborne flaw Researchers warn that firmware backdoors planted on bare-metal cloud servers could later be exploited to brick a different customer’s server, to steal their data, or for ransomware attacks. By Ms. Smith Feb 26, 2019 3 mins Cloud Computing Security news Meet the man-in-the-room attack: Hackers can invisibly eavesdrop on Bigscreen VR users Flaws in Bigscreen could allow 'invisible Peeping Tom' hackers to eavesdrop on Bigscreen VR users, to discreetly deliver malware payloads, to completely control victims' computers and even to start a worm infection spreading through VR By Ms. Smith Feb 21, 2019 4 mins Hacking Vulnerabilities Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe