Lose The Burners: Court Okays Prepaid Phone Tracking

Prepaid cellphone users may be tracked by law enforcement agencies at any time, without police first having to obtain a probable-cause warrant.

That's one takeaway from a 23-page ruling issued Tuesday by the U.S. Court of Appeals for the Sixth Circuit. The ruling centers around a case involving Melvin Skinner, who was convicted by a jury of drug trafficking and money laundering for his role in what the court described as "a large-scale drug-trafficking operation."

Skinner was busted after law enforcement agents "pinged" his location, tracking him using cellphone towers. "The government used data emanating from Melvin Skinner's pay-as-you-go cell phone to determine its real-time location. This information was used to establish Skinner's location as he transported drugs along public thoroughfares between Arizona and Tennessee," said U.S. Circuit Judge John M. Rogers in his opinion, which was written for the majority. "As a result of tracking the cell phone, DEA agents located Skinner and his son at a rest stop near Abilene, Texas, with a motorhome filled with over 1,100 pounds of marijuana."

[Learn about a controversial new crime surveillance system. NYC, Microsoft Team On Huge Surveillance System.]

Skinner was sentenced to 20 years in jail. But he appealed, arguing that under the Fourth Amendment--which guarantees that people should remain free from unreasonable searches or seizures--he should have been protected from having the DEA monitor his whereabouts without a warrant for probable cause.

In a 2-1 ruling, however, the appeals court found that Skinner's Fourth Amendment rights hadn't been violated. According to Rogers, "Skinner did not have a reasonable expectation of privacy in the data emanating from his cell phone that showed its location." Furthermore, according to the court's ruling, "if a tool used to transport contraband gives off a signal that can be tracked for location, certainly the police can track the signal."

Cellphone data now plays a part in numerous investigations. Last month, a congressional inquiry found that telecommunications carriers last year fielded 1.3 million requests for subscriber information, including phone location data and text messages, from law enforcement agencies. But many such requests, including whether they would require a warrant, had been subject to some differing judicial interpretations.

The ruling now makes clear what privacy protections prepaid cellphone users can expect, or not. "By ruling in this way, the court has acknowledged that it is specifically legal to engage in a range of law enforcement activities which until today had lived in a sort of nether-world or gray area of the law," said Nick Selby, managing director of TRM Partners, on his Police-Led Intelligence blog.

"Perhaps the most important single statement in the ruling refers to the fact that there is no Fourth Amendment violation in use of these techniques because there is no reasonable expectation of privacy in the voluntary use of a voluntarily bought phone--even one that is pay-as-you-go," said Selby. "Criminals have long believed that the lack of a contract is some magical way of disallowing attribution of a device to a specific person, which is clearly not the case if the device is found upon his person at the time of arrest."

The court was careful, however, to distinguish between the DEA's tracking of Skinner, and the recent Supreme Court decision involving United States versus Jones. In that case, the court ruled that police had trespassed on the rights of Antoine Jones during a narcotics investigation by secretly attaching a tracking device to his car without first obtaining a warrant. Such practices were apparently widespread, as the Jones decision led to the FBI deactivating about 3,000 GPS-tracking devices.

After already enjoying popularity in criminal circles, "burners" entered the public consciousness in 2004, with the third season of the HBO television show The Wire, in which Baltimore police try to unravel the workings of a Baltimore drug crew that uses a communication network based on disposable cellphones. "Burner" moniker aside, one-quarter of U.S. residents use prepaid or pay-as-you-go cell phones, according to statistics cited by security and privacy Christopher Soghoian.

Thanks to the appeals court's ruling, all burner users beware: you may now be tracked by police, no warrant required.

One of the biggest challenges facing IT today is risk assessment. Risk measurement and impact assessment aren't exact sciences, but there are tools, processes, and principles that can be leveraged to ensure that organizations are well-protected and that senior management is well-informed. In our Measuring Risk: A Security Pro's Guide report, we recommend tools for evaluating security risks and provide some ideas for effectively putting the resulting data into business context. (Free registration required.)