← The Lawfare Podcast
Loading summary
Transcript65 lines
- [00:01]
Lawfare Host
The following podcast contains advertising to access an ad free version of the Lawfare Podcast. Become a material supporter of lawfare@patreon.com lawfare that's patreon.com Lawfair also check out Lawfare's other podcast offerings, Rational Security Chatter, Lawfare, no Bull and the Aftermath.
- [00:32]
OpenPhone Advertiser
If you're running a business, you know that every time you miss a call, you're leaving money on the table. When every customer conversation matters, you need a phone system that keeps up and helps you stay connected 24, 7. That's why you need OpenPhone. OpenPhone is the number one business phone system that streamlines and scales your customer communications. It works through an app on your phone or computer, so no more carrying two phones or using a landline. Plus, say goodbye to voicemail. Their AI agent can be set up in minutes to handle calls after hours, answer questions, and capture leads so you never miss a customer. OpenPhone is offering our listeners 20% off of your first six months at openphone.com tech that's O-P-E-N P-H-O-N-E.com tech and if you have existing numbers with another service, OpenPhone will port them over at no extra charge. Open Phone no missed calls, no missed.
- [01:25]
BetterHelp Advertiser
Customers BetterHelp Online Therapy bought this 30 second ad to remind you right now, wherever you are, to unclench your jaw, relax your shoulders, take a deep breath in and out. Feels better, right? That's 15 seconds of self care. Imagine what you could do with more. Visit betterhelp.com randompodcast for 10% off your first month of therapy. No pressure, just help. But for now, just relax.
- [02:14]
Matthew Tokeson
Foreign.
- [02:21]
Carolyn Cornett
I'm Carolyn Cornett, intern at Lawfare, with an episode from the Lawfare Archive for May 25, 2025. Last week, Russell Vaugh, acting director of the Consumer Financial Protection Bureau, canceled a proposed rule that would have limited the ability of data brokers to sell sensitive information about consumers and including financial data, Social Security numbers and more. While those plans will not go into effect at the federal level, Montana recently became the first state to pass a law banning the government from buying private information without a warrant. For today's archive episode, I selected an episode from December 4, 2023, in which Stephanie Pell sat down with Matthew Toxin to discuss the government's press practice of purchasing consumer data to bypass Fourth Amendment restrictions. They talked about why the purchase of private data may or may not violate the Fourth Amendment, recommendations to address privacy concerns, and more.
- [03:30]
Stephanie Pell
I'm Stephanie Pel? Cinder, Senior Editor at Lawfare and this is the Lawfare Podcast, December 4, 2023. Is the Fourth Amendment doing any work anymore? In a forthcoming article entitled Government Purchases of Private Data, matthew Tokeson, a professor at the University of Utah S.J. quinney College of Law, details how in recent years, federal and state agencies have begun to purchase location information and other consumer data as government attorneys have mostly concluded that purchasing data is a valid way to bypass Fourth Amendment restrictions. I sat down with Matthew to discuss this article where he attempts to bring this constitutional evasion to light. We talked about the two main arguments offered for why the purchase of private data does not violate the Fourth Amendment, his responses to these arguments and the recommendations he makes to courts, legislators and government agencies to address the Fourth Amendment and privacy concerns surrounding government purchases of private data. It's The Lawfare Podcast, December 4th. Matthew Tokeson on government Purchases of Private Data. Matthew, can you start by telling us what prompted you to write this article?
- [04:53]
Matthew Tokeson
Yeah, actually it was an article that I read online about the Barnstable, Massachusetts Police Department, Barnstable being on Cape Cod purchasing location data on people purchasing a service where they could track people's location data via their cell phones. And Barnstable, Mass. I associate it with the Cape Cod of my youth, this sort of small town, not a whole lot of crime there. And it just sort of struck me and shocked me a little bit that the Barnstable Police Department felt that they needed to closely track people's locations. And that's sort of when I had heard earlier stories about the government purchasing, you know, location data for, for various purposes. But that's when I it sort of struck me that this had grown to a sort of crazy extent and was a little more ubiquitous than I thought. And that's basically when I decided to write the article.
- [05:48]
Stephanie Pell
Can you describe the kinds of data that law enforcement are purchasing?
- [05:53]
Matthew Tokeson
For the most part, it's data collected by cell phone apps. There are other sources of information, but that's sort of the main one. And typically we're talking about location data that apps might collect, oftentimes weather apps, games, you know, could be dating apps, things like that. They, these apps collect this data for marketing purposes mostly and they sell it to data brokers. Some data broker have created software that can help law enforcement track people with this data. Now there's, there's other data as well that government agencies have purchased, often Internet traffic data like IP logs and things like that where it's a little hard to know exactly what they can tell. But typically if you have a list of IP addresses that people have visited, you can sort of tell where they've been on the Internet. So that could be very sensitive. And then there's. There's other types, but those are sort of the big main categories that I'm aware of.
- [06:47]
Stephanie Pell
And you referenced the fact that data brokers are selling these data sets. Is that the primary kind of company that is selling these data sets, or are there other companies as well?
- [07:01]
Matthew Tokeson
I think that's the primary kind of company. But typically when we're talking about the company that's, you know, selling to law enforcement, it's often a specialized subsidiary of a larger data broker. And they might. They typically create sort of specialized software that can help track phones or, you know, other units within a location, or perhaps, you know, enter someone's name or other information or enter a cell phone number and sort of reverse look them up. In other words, the tracking function of this software tends to be a lot greater and a lot more capable than what you purchase from a data broker if you were, you know, an advertising company, which is usually just going to be sort of a big block, a huge Excel spreadsheet or other database of anonymized consumer information.
- [07:50]
Stephanie Pell
So as you were researching and writing this article, I think you came across cases and situations where law enforcement purchased location data. And we're now seeing how these data are actually being used in an investigation. Can you give us an example of that?
- [08:12]
Matthew Tokeson
Sure, yeah. My favorite example is it was a government agency purchases data around the border, and they're seeing cell phones transit back and forth across the border in a very straight line. And they eventually figure out that this is an underground sort of smuggling tunnel. The tunnel begins in a house on the Mexico side, and it terminates in a Kentuck Fried Chicken on the United States side. This is a Kentucky Fried Chicken that went out of business. And they. They use this data to sort of figure out that the owner of this Kentucky Fried Chicken was involved in drug trafficking. But they don't want to sort of expose that they. That they know this or that they're purchasing this data. So they contact local law enforcement. I believe this is in Arizona. And they say, look, there's this. There's this individual, his name's Ivan Lopez. You're going to want to pull him over. We suspect he has lots of drugs in his car. So the. The local police pull him over, basically on a pretext. They said that there was an equipment violation, like a, you know, tail light was out or his license plate was obscured or something like that. They pull him over, they find the drugs that the government already knows are there and they sort of prosecute him from there. So it's. It's an example of the government using this data, which originally collected for immigration enforcement in this case, and giving it to another police agency and also sort of hiding the fact that they've obtained these massive sort of databases of location data by purchasing them.
- [09:39]
Stephanie Pell
And I know we'll touch on this probably later in the conversation, but seems to be one of the challenges of learning and regulating these practices are the fact that law enforcement uses of these data are often obscured downstream in investigations where they may provide leads.
- [10:02]
Matthew Tokeson
That's right. I think largely at the direction of the data brokerage companies themselves. These companies want to keep this stuff out of court. They don't want the constitutionality of this to be tested in court because it's. I argued that it's not constitutional. I think at the very least, it's an issue that's up in the air whether this is legal or not. And so if you can keep this out of court, then it won't be held unconstitutional. You can keep selling this data. So these companies often have contracts in place, almost like nondisclosure agreements that say, don't mention our product in a public record. Don't mention our product in court. You can use it to generate leads and sort of dig this evidence up through other means. That's a process referred to as parallel construction. And it's sort of a way of hiding surveillance techniques. We see that a lot when we're looking at government purchases of private data.
- [10:51]
Stephanie Pell
So who is allowed, so to speak, to purchase these data sets? You've talked about law enforcement purchases, but are they marketed and sold to other audiences as well?
- [11:02]
Matthew Tokeson
When we're talking about the sort of tracking, specialized software, those seem to be marketed exclusively to law enforcement. And there are companies that will sell these services to law enforcement, and they'll also help them throughout their investigation to, you know, de anonymize an anonymous phone number, for example. You know, the marketing, at least, is very specialized towards law enforcement. And if you try to purchase these services, you're not going to be able to, I guess, unless you lied about who you are, perhaps in terms of location data in general, sort of more raw data without the specialized tracking ability. That stuff can be sold, is often sold from company to company, from a data broker to an advertising service to a marketer, you know, marketing analysis, sometimes to credit card companies. But that's when we're talking about that data. As I said, typically we're talking about Large anonymized databases. Now it is possible to de anonymize that information. Sometimes you can purchase information that's linked to names, but this is business to business sales. I have, purely out of academic interest, I've tried to purchase, you know, useful location tracking information just to see if I could do it. And it's, there's just not a consumer facing sort of store you can go to. You know, there's no stocking store where you can stock whoever you like. This information is not available to the public. You know, with sufficient expertise, if you start a corporation, if you have millions of dollars, you might be able to get this information and process it in a way that could be useful for tracking someone, but that's not really available to the, to the general public in any meaningful way. It's, it's hard to get if you're not a corporate entity. And the really useful stuff is almost impossible to get unless you're law enforcement.
- [12:52]
Stephanie Pell
And so the fact that the data is not generally available to the public, I think sets up nicely the main argument you make in your article, which is that law enforcement's purchase of location data likely violates the fourth Amendment. So first of all, I want to start with the question of if law enforcement wasn't purchasing location data, how would it normally be required to obtain it? Is there a particular case that provides some insight to that question?
- [13:26]
Matthew Tokeson
Yeah, absolutely. In 2018, sort of the last major Fourth Amendment case is called Carpenter versus United States. And the Supreme Court decides in that case that the police can't obtain cell phone location data without a search warrant. What they were doing prior to Carpenter is there was a statute that sort of allowed you to get a court order, very easy to get. And you could get a court order, send it to Verizon or Sprint or whoever and say, give us the location data for the past six months on, you know, 1-800-whatever, whatever phone number. And so police were doing that in a fairly often. It was a fairly common investigative tactic. The Supreme Court said, look, this data can be very revealing. There's a lot of it out there. It's very sensitive and private. And so we're going to require you to obtain a search warrant before getting it. You know, even though it's held held by the cell phone company and sort of is not your traditional private data, they extended the fourth Amendment to that location information. So that was sort of the pre Carpenter police were just sort of getting it directly through what's called the 2703d court order, which Again, was fairly easy to get with a lower standard than probable cause.
- [14:41]
Stephanie Pell
And for the Electronic Communication Privacy act nerds out there, the 2703d order is part of that statute, I presume?
- [14:50]
Matthew Tokeson
That's correct. It often referred to as the Stored Communications act, like this particular portion of the ecpa, but it's all the ecpa. That's correct.
- [15:00]
Stephanie Pell
And the Carpenter case, as you noted, dealt with historical cell site location information, or often called csli, but with the type of data that you've been talking about, we're in many circumstances talking about much more precise location data from these apps. Is that a fair assessment?
- [15:24]
Matthew Tokeson
That's right. CSLI is sort of location data that you obtain from the radio waves of a cell phone hitting various cell phone antennas throughout the city or town that you live in. And depending on how many cell phone towers there are, it can be more precise or less precise. But the cell phone location data that is available for purchase is typically not csli. It could be, but it's typically not typically app generated. And that's often more precise because it's usually GPS based. And so you can usually pinpoint people a little more accurately with that information than with csli. You know, the flip side of that is it's not as universal as csli, perhaps depending on the user, because CSLI is generated whenever a cell phone is on, but it is often much more precise and sort of can reveal even more about a person's life because it follows them so closely.
- [16:20]
Stephanie Pell
And as best you can tell, did the growth in law enforcement purchase of location data begin occurring after the Carpenter decision?
- [16:29]
Matthew Tokeson
Yes. I found that very interesting that a lot of major purchases of cell phone location data were made by government agencies, especially federal agencies, almost immediately after Carpenter in the summer of 2018, which is Carpenter, was released in the. In the early summer of 2018. And so, you know, a month later, a few weeks later, some of the, you know, Department of Homeland Security and the Defense Intelligence Agency are making purchases of cell phone location data. Now, this is circumstantial evidence, but it seems reasonably likely that they were making these purchases in order to engage in the location tracking that had just been declared unlawful without a warrant by the Supreme Court. So I think that timing is very revealing, at least in some cases.
- [17:15]
Stephanie Pell
So, as you've indicated, prior to Carpenter, for the most part, the government was using these 2,703 orders, which have a lower standard than a probable cause standard that you find in a warrant to obtain csli. Then Carpenter happens, and then we see this growth in the purchase of location data. So as you understand it, what are law enforcement's best arguments for why they can purchase what they would otherwise be generally required to get a warrant to obtain? And if I know you make several arguments in the article, so let's take them one, one at a time.
- [17:59]
Matthew Tokeson
Sure. So I think the first main argument that government attorneys have made is because this stuff is commercially available, it is unprotected by the Fourth Amendment. And the basis for that is the sort of general rule based on a case called Maryland vs. Macon from a while back, that the police officer can go into a store that's open to the public and purchase goods or what have you that, that any member of the public might purchase. And that's still good law. So I think they're trying to draw an analogy between, you know, purchasing something in a store and purchasing location data.
- [18:36]
Stephanie Pell
But that's not an argument that you find terribly convincing.
- [18:40]
Matthew Tokeson
I don't, in large part, because as we talked about a little bit, I don't think this stuff is really available to the public in any meaningful way. Again, I haven't been able to purchase it. There's no store you can go to and purchase detailed location data on someone, certainly not in a way that's useful for tracking either. And so that takes it out of that sort of realm of being publicly available in the first place. I would also say that under cases like Kyllo versus United States and some prior cases, the court has looked at, you know, types of surveillance that a member of the public can in theory undertake and basically said, look, if this isn't in general public use, if this isn't something that happens more than very rarely, we're not going to hold that to sort of erode the Fourth Amendment protections for something. Right. In Kyllo, there was. The police used an infrared camera to scan the outside of someone's house. Now, you or I could buy an infrared camera. It's unlike this location data. We could. We could buy an infrared camera. We can likely scan the. Inside, the outside of someone's house from a public area without getting in trouble for it. Although I suppose maybe they'll sue us. That's sort of up in the air, but very neighborly. Yeah, it wouldn't be. Yeah, they would. They would probably give us a dirty look and not understand what we were doing with this large camera. But. But the. The court said, yeah, sure, a member of the public could do that, a contractor or someone could do that. That's typically who uses these cameras. But it's not in general public use. This is not something that is widely used enough to erode reasonable expectations of privacy. And I think there's an analogy to that, to this situation where, you know, even if a few sophisticated actors might be able to purchase this data, that's not enough to say that the fourth Amendment doesn't protect it. And it's certainly nothing like a situation where you walk into a store and purchase something and so the police officer should be able to do the same thing. I think this is, you know, quite different from that. Accordingly, I think the fourth Amendment still protects this data, which is, as the Supreme Court has said to CS Alive, something very similar in is private, you know, is generally protected by the fourth Amendment.
- [20:53]
Lawfare Host
Hey, do you insure your car, your home? Do you have a personal liability policy in case someone sues you? Unless you're Elon Musk, it's a good idea because if something bad happens, you want to be protected. But what about you? Are you protected? What happens to your income, your family's future if something happens to you? Hit by a bus, plane crash, heart attack? Stuff happens. Policygenius makes finding and buying life insurance simple. Ensuring that your loved ones have a financial safety net they can use to cover debts and routine expenses. You can compare quotes from top insurers and find coverage that fits your needs and your budget. With Policygenius, you can find life insurance policies starting at just $276 a a million dollars in coverage. It's an easy way to protect the people you love and feel good about the future. Okay, this is a true story. A couple of years ago, my cabin in the woods flooded and was almost completely destroyed. And the insurance company, my homeowner's insurance, didn't pay a dime to rebuild. We were stuck with the whole cost of it. Can you imagine doing that if say, you had a mortgage to service on a property and your partner was gone? Life insurance can cover loved ones expenses if something happens to you. Mortgage payments are a common cost that could be covered by life insurance too. So I have life insurance because I don't want my family to have to worry about money after I'm out of the picture. Policy genius is a great way to get the right policy for you. Combining digital tools with the expertise of real licensed agents, you can compare quotes from America's top insurers side by side for free. Policy Geniuses Licensed Support Team helps you get what you need fast so you can get on with your life. They answer questions, handle paperwork and advocate for you throughout the process. Life insurance is not a one size fits all product, and policy genius doesn't treat it like one. They lay out all your options clearly. Coverage, amounts, price is terms, no guesswork, just clarity. So check life insurance off your to do list in no time with Policygenius. Head to Policygenius.com or click the link in the description to compare free life insurance quotes from top companies and see how much you could save. That's policygenius.com.
- [23:46]
Matthew Tokeson
I have this nightmare that.
- [23:47]
Stephanie Pell
I never finished college or that someone's going to find out that I don't have the qualifications for this job and I'm like a total fraud.
- [23:54]
Matthew Tokeson
Sometimes even the most successful people experience Imposter Syndrome. Check out Mind if We Talk?
- [24:00]
Stephanie Pell
The newest podcast helping you with tough topics. In this episode, licensed therapist Jesu Jo.
- [24:06]
Matthew Tokeson
Sits down with award winning journalist Jane Marie to explore why so many of us have Imposter syndrome and why success never seems to solve it.
- [24:15]
Stephanie Pell
Whether you've ever questioned your own success or felt like the odd one out.
- [24:18]
Matthew Tokeson
This episode's for you.
- [24:19]
Stephanie Pell
Listen and subscribe to Mind if We Talk?
- [24:22]
Matthew Tokeson
Wherever you get your podcasts.
- [24:25]
OpenPhone Advertiser
If you're running a business, you know that every time you miss a call, you're leaving money on the table. When every customer conversation matters, you need a phone system that keeps up and helps you stay connected 24 7. That's why you need open phones. OpenPhone is the number one business phone system that streamlines and scales your customer communications. It works through an app on your phone or computer, so no more carrying two phones or using a landline. Plus say goodbye to voicemail. Their AI agent can be set up in minutes to handle calls after hours, answer questions and capture leads so you never miss a customer. OpenPhone is offering our listeners 20% off of your first six months at openphone.com tech. That's O P E N P-H-O-N-E.com tech and if you have existing numbers with another service, OpenPhone will port them over at no extra charge. Open Phone no missed calls. No missed customers.
- [25:19]
BetterHelp Advertiser
This is Paige, the co host of Giggly Squad. I use Uber Eats for everything and I feel like people forget that you can truly order anything, especially living in New York City. It's why I love it. You can get Chinese food at any time of night, but it's not just for food. I order from CVS all the time. I'm always ordering from the grocery store. If a friend stops over, I have to order champagne. I also have this thing that whenever I travel, if I'm ever in a hotel room, I never feel like I'm missing something because I'll just Uber Eats it. The amount of times I've had to Uber eats hair items like hairspray, deodorant, you name it, I've ordered it. On Uber Eats, you can get grocery alcohol, everyday essentials in addition to restaurants and food you love. So in other words, get almost anything with Uber Eats. Order now for alcohol. You must be legal drinking age. Please enjoy responsibly. Product availability varies by region. See app for details.
- [26:22]
Stephanie Pell
And has there been any court that has addressed this question of whether law enforcement's purchase of private data violates the Fourth Amendment rights under Carpenter?
- [26:32]
Matthew Tokeson
Yeah, there has been one court that looked at a service that was working closely with law enforcement. And so they were, law enforcement were basically purchasing a tracking service from them. They would ping someone's cell phone and get sort of a CSLI like response as to where a person was at any given moment. The only reason this made it to court was there was a criminal prosecution that sort of obliquely mentioned it. And so the party took a, took offense to that, sued for a constitutional violation under section 1983. And, and so this got evaluated by the court and the court basically said, we think that this company is so closely working with the government to track these people that it's essentially a state actor. So I think there are some lessons there for a lot of the tracking services that I study, which also work closely with the government to help them track people, often work to help them de anonymize people once they have a target in mind. It may not be exactly the same because the way that a company tracks someone may vary. This may have been more involved. Some other companies may have less direct involvement. But according to the one case, sort of on this issue, at least at the time that I wrote the piece, which was fairly recently, that court said, look, this is unconstitutional. This is basically a private company doing a government function engaging in state action and violating people's privacy under the Fourth Amendment.
- [28:02]
Stephanie Pell
And was that a district court opinion?
- [28:05]
Matthew Tokeson
Yes. Yeah, that was, that was just a district court opinion. So we still, it still remains to be seen what the federal appeals courts will say about it. And certainly the Supreme Court hasn't addressed this particular issue at all.
- [28:18]
Stephanie Pell
So you make a second or you identify a second argument that government attorneys generally make about why they don't need to obtain a warrant to get this kind of location, purchase this kind of location data.
- [28:33]
Matthew Tokeson
Yeah, that's right. They also argue, in addition to the fact that it's purchased. That because cell phone users typically, you know, hit sort of permit on their apps to allow the app to collect data, that they may have no reasonable expectation of privacy in the data. Even under Karpenter. Right. In Karpenter with csli, you sort of have no choice but to reveal it. Here they're saying, oh, they sort of give permission for the apps to collect it.
- [29:01]
Stephanie Pell
Can you unpack that a little bit? I mean, basically is the argument that somehow every time I give an app permission to collect data, that I am simultaneously giving it permission to share data in a way that then diminishes my fourth Amendment rights?
- [29:22]
Matthew Tokeson
Yeah, that is the argument. And I push back on that in my piece for a couple reasons. One is I think this, if we're talking about consent to like a Fourth Amendment search, I don't think merely, you know, giving weather.com's weather app, you know, permission to view your location is anything like, you know, giving consent to the government to collect that information downstream and use it against you. It's also the case that I don't think, you know, 99% of people, when they're clicking, you know, yes on the app, have a sense of where that data might go, even, you know, excluding law enforcement. If we're just talking about data brokers and subsequent sales to third party marketers, you know, that stuff's not disclosed in the, in the initial permission screen. The permission request is typically really minimal. Doesn't really say almost anything about how the information will be used, especially when we're talking about marketing. And so I don't think it's a meaningful waiver of any constitutional right for those reasons. It's also, I think, the case that usually it's not much of a choice. It's a choice, but it's not really a choice. You can deny your app's permission to collect various kinds of data, but oftentimes they won't work or they won't work properly. You know, they'll be, they'll be greatly diminished. So for these and even more reasons, I think giving an app permission to collect your data is not sufficient to sort of waive your fourth Amendment right in that, in that data, if it's otherwise private, if it's otherwise sensitive.
- [30:56]
Stephanie Pell
Under Carpenter, we have not seen that particular issue in this context addressed by a court yet.
- [31:04]
Matthew Tokeson
Yeah, I think that's right. I mean, you see it a little bit in the geofence warrant context. A completely different sort of issue involving, you know, location data collected by Google and obtained usually via a warranted search. Although geofence warrants are sort of their own special thing where the police get a warrant for all the cell phones in a location. So I think there have been a case or two that talk a little bit about, you know, is that, do people give their, their permission for that? But even that's a little bit different because Google is a little more detailed in its, in its disclosures. So, you know, some, some lower courts especially have touched a little bit on these issues, but not in a way that I think is particularly useful for analyzing it in the government purchases context.
- [31:50]
Stephanie Pell
Now, in addressing some of the privacy implications of law enforcement's ability to purchase private data, you talk about the interoperability of private and law enforcement surveillance. Can you explain what you mean by that?
- [32:07]
Matthew Tokeson
Yeah, this is a concept borrowing from Karen Levy, who has this great book about private surveillance, or rather public surveillance of long haul truckers and how that's been used by their employers sort of against them. They sort of piggyback on the government's tracking of the truckers for safety, which is done for safety reasons. And she talks about the interoperability of government surveillance and private surveillance. Right. Once the government has, you know, sensors in place to sort of make sure the long haul truckers aren't driving too much or driving too fast or et cetera, the private entities can use that to track them as well. This is, I believe her book's called Data Driven. And it's really like this concept from that and like Caroly's work. But so I think what we're seeing is sort of the reverse of that here, which is we have sort of extensive private data collection, right? Private, not so much private surveillance, but just extensive collection of consumer data as they use their cell phones, as they surf the Internet, you know, as they move about the world. That data is collected almost exclusively for marketing purposes because it has some monetary value, because you can sell it to advertisers and marketers. But because that data collection is so unregulated and so ubiquitous, it creates an opportunity for law enforcement. And the government has now identified that opportunity. That's why we see, I think, an increase in government purchases in recent years. And so instead of creeping from sort of government surveillance to private surveillance, we're creeping from private data collection to government surveillance. And that's the interoperability. The same data that, you know, your, the Angry Birds app collects on you might be useful to law enforcement. And they increasingly are able to obtain it.
- [33:55]
Stephanie Pell
So I want to talk about some of the solutions to these issues that you propose in your article. And I want to start with how you would advise courts to address the problem. And I would just focus back on a comment that you made earlier in this discussion. And that is that oftentimes it is difficult for courts to even rule on these issues because the purchase of the data is obscured in the investigation. So it really never fully comes to light. And it's often difficult then for defense attorneys to raise these issues.
- [34:36]
Matthew Tokeson
Yeah, that's right. Often in the Fourth Amendment context there are judicial solutions. And I've typically been an advocate of court based solutions for a lot of Fourth Amendment questions. Here it might be a little different because it's often it's so rare for government purchases to come before a court because the data companies selling them are so reluctant to allow them to come into court, you know, to even be mentioned in court. So they're being used in the background, but it's, they're tough to challenge. And so if we're talking about a sort of judicial solution, it's often going to be, there's going to be a preliminary step which is doing like a FOIA request or engaging in FOIA litigation or other transparency litigation to even get the information about what the government is doing, if you can. And there's some great people who write about that, Rebecca Wexler, Hannah Block Weber, they, they've written some articles that I find useful about sort of transparency led litigation in the law enforcement area. But so you'd almost have to prevail in like a, you know, a FOIA litigation or at least with a FOIA request to figure out what, you know, a given government agency or police department are doing. Once you have that information, maybe there could be a lawsuit and it would get into court. But short of that, it might be difficult to weigh these things in court. And so in this context, there may need to be a statutory solution. And there are members of Congress, Ron Wyden in particular, who's often a leader in privacy issues, who have been working on legislation to prevent sales of consumer app data to law enforcement. Senator Wyden proposed, I believe it's called the Fourth Amendment is Not for Sale Act. It has not yet passed, but you know, is still being revised and potentially re proposed. And there are other potential avenues of statutory law that might work that way. But there's a lot of things you could do either to directly prohibit this stuff or we could also obtain the sort of long lost comprehensive privacy law at the federal level that we haven't really had. We have the ECPA, which was passed in the 80s and has been amended pretty minimally since that is not really an effective comprehensive data privacy law for consumers. So we could have a more consumer friendly privacy law at the federal level, something that's a little bit more like Europe's gdpr, where consumers have more rights and more protections, where companies have to get explicit consumer permission for downstream sales. And that requirement in particular is relevant here because if you. The way these markets flourish is once an app collects your data, they can sort of do what they want with it downstream, even without your permission. They don't really get your permission for the downstream stuff. They collect it, they might get your permission for that, but then they sell it without your knowledge and certainly without your permission. In the European context, under the gdpr, you typically would need consumer permission for every subsequent use of the data. They use it initially for whatever purpose they're going to sell it to a data broker. If they're going to sell it to law enforcement, they would need to get your permission. And I think that kind of requirement would also likely prevent government purchases of sensitive private data, because I don't know who or why anyone would give their permission to sell their data to law enforcement. Right, maybe if you offered them a ton of money, but I don't think they're going to give it up for free, which is basically what they're doing now under current US law. So there are a variety of statutory solutions that might prevent government purchases of sensitive data.
- [38:20]
Stephanie Pell
And what about government agencies? Are there things that you think they should be doing now? Notwithstanding the fact that the courts aren't currently preventing the sale and purchase of this data by law enforcement, and the fact that, as we are recording this podcast, you know, Congress has not taken any significant measures to limit its sale and purchase.
- [38:47]
Matthew Tokeson
Yeah, agencies may play a really useful role here. The FTC has looked into more vigorous consumer data enforcement. They are typically the agency that has done the most previously, typically through case by case litigation and adjudication. But they have looked at some more comprehensive regulation. Whether or not that will actually happen, I'm not sure. But they certainly have the capability, I think they have the statutory authority to promulgate rules that might get us a large part of the way towards preventing downstream uses of sensitive consumer data, even directly preventing government purchases of private data. I think the FTC could certainly do that. And they have at least looked into expanding their protections for consumer data. I don't know if they've looked specifically at government purchases, but, you know, these issues are on their radar. There was recently a government a study of government purchases, you know, throughout the throughout the government by intelligence agencies that sort of touched on the massive scope of this practice. And so I think there's a little bit more awareness out there. Remains to be seen whether the FTC or I suppose some other agency might come to address it, but I think they have the capability and to some extent the interest in addressing these purchases.
- [40:10]
Stephanie Pell
Is there anything else that you would like to share with our listeners?
- [40:14]
Matthew Tokeson
I would just say to keep paying attention to this issue, I think there will be some opportunities to get legislation on the agenda that may prevent government purchases of sensitive data and any contact with congresspeople. Any sort of social media activity about this issue can help. Eventually it may also reach the courts, which would be really exciting to me. So, you know, it's a ongoing issue. I think it's exciting. 1 Stay tuned. We'll see what the future brings.
- [40:47]
Stephanie Pell
Fair to say that for Fourth Amendment nerds, it's a really hot issue.
- [40:52]
Matthew Tokeson
I think so. Certainly for this Fourth Amendment nerd, I'm very excited about it and will continue to be even after the paper is out and finished.
- [41:01]
Stephanie Pell
Well, we'll have to leave it there today. Thanks so much for joining me.
- [41:05]
Matthew Tokeson
Thank you. Thank you. This was a pleasure.
- [41:10]
Stephanie Pell
The lawfare Podcast is produced in cooperation with the Brookings Institution. You can get ad free versions of of this and other lawfare podcasts by becoming a Lawfare material supporter through our website, lawfairmedia.org support. You'll also get access to special events and other content available only to our supporters. Please rate and review us wherever you get your podcasts. Look out for our other podcasts including Rational Security, Chatter, Allies and the AfterMath. Our latest Lawfare presentation podcast series on the government's response to January 6th. Check out our written work@lawfaremedia.org the podcast is edited by Jen Patya Howell and your audio engineer. This episode was Noam Osband of Goat Rodeo. Our music is performed by Sophia Yan. As always, thank you for listening.
- [42:10]
BetterHelp Advertiser
This is Paige, the co host of Giggly Squad. I use Uber Eats for everything and I feel like people forget that you can truly order anything, especially living in New York City. It's why I love it. You can get Chinese food at any time of night, but it's not just for food. I order from CVS all the time. I'm always ordering from the grocery store. If a friend stops over, I have to order champagne. I also have this thing that whenever I travel, if I'm ever in a hotel room. I never feel like I'm missing something because I'll just Uber Eats it. The amount of times I've had to Uber eats hair items like hairspray, deodorant, you name it, I've ordered it. On Uber Eats, you can get grocery alcohol everyday essentials in addition to restaurants and food you love. So in other words, get Almost anything with UberEats. Order now for alcohol. You must be legal drinking age. Please enjoy responsibly. Product availability varies by region. See app for details.