While the technological power to gather citizens’ digital data is exploding — through facial recognition software, GPS tracking, cell phone data, and drones — courts and legislatures have barely woken up to the issue.

Like a ringing alarm clock, Yale Law School recently held a day-long conference highlighting the unanswered policy questions of location tracking and biometrics. Sponsored by the Information Society Project at Yale Law School, it featured many of today’s top thinkers in the field.

The panels were studded with a famous circuit judge and federal magistrates, privacy advocates, civil rights scholars and leading information tech scientists. They contrasted the high-speed developments with the lagging pace of courts and legislatures struggling to grasp the legal and policy implications.

One illustrative highlight: Carnegie Mellon University scientist Ralph Gross reported on his experiments that started with anonymous photos from dating sites. These he matched, with facial recognition software, with the Facebook social media database of faces and identities. From there, he could accurately identify the first five digits of the Social Security numbers of 27 percent of his originally anonymous dating site pool.

Peoples’ faces, he explained, are becoming a pathway to a storehouse of digital data often presumed private. "We can go from a face and end up with a Social Security number," Gross said.

Cell Tracking

The legal springboard behind the Yale event was the 2012 U.S. Supreme Court case of U.S. v. Jones, in which a criminal defendant was trying to get evidence thrown out. For 28 days, police had secretly monitored a GPS device attached to a nightclub owner’s car, in pursuit of a drug arrest. A divided Supreme Court concluded this was indeed a search, but the justices never reached the issue of whether large amounts of location tracking data exceeded reasonable expectations of privacy, necessitating a warrant.

Christopher Soghoian, technologist and policy analyst for the American Civil Liberties Union, started the day by explaining cell phone location tracking. Federal law requires cell phone companies to track customers’ locations. It helps in emergencies, rescues and in fighting crime. Some carriers use Global Positioning Satellite data, and other can locate cell phones by triangulating between cell towers. How fine is their focus? That greatly depends, he said, on whether the setting is rural or urban, since cities are peppered with tower locations.

Police typically don’t need warrants to research cell phone location records, Soghoian explained. Over the years, due to the increasing volume of requests, the phone companies created self-service access for police departments requesting data. One type of request is a "tower dump" — all cell phones within range of a crime scene at a specific time, for example.

Cell location data can be extremely narrow — especially for people who have arranged to get a "phemtocell" in their homes or businesses as a cure for bad service. These are essentially miniature cell towers that carriers can provide people who have poor cell reception in a home or workplace. Using a WiFi wireless Internet connection, the phemtocell provides a room-sized area of cell reception.

Parallel Commercials

In the first panel, focusing on the Jones decision, Alex Kosinski, chief judge of the U.S. Court of Appeal for the Ninth Circuit, noted that the government does not need a warrant to search for information people have already disclosed information to third parties. Furthermore, he said, "The world we live in now is one where we constantly disclose information to third parties, often unwillingly."

An ever-increasing amount of personal data is being gathered through retail and Internet commerce, where people have consented to share that information. So far, he noted, people have been quite willing to exchange their privacy for free Google and other Internet conveniences.

As an example of the change, he noted that data from credit card purchases can now be used to program different TV commercials to two neighbors watching the same show.

"If you are there at home, guys," said Kosinski, "and you get a Viagra commercial, it may be that they think something about me that I don’t want disclosed to the world? Or is that everybody got this Cialis or Viagra commercial? Chances are very good you got the Viagra commercial for a reason."

While calling this "creepy," Kosinski noted that constitutional case law sets a low bar for waiving an expectation of privacy. He gave the example of Hoffa v. U.S., a 1966 U.S. Supreme Court case in which Teamsters Union president Jimmy Hoffa was not able to invoke attorney-client privilege. It was ruled that he had waived it by allowing union meetings to include an undercover government agent. The court’s reasoning, Kosinski noted, was that, "If you happen to be dumb enough to choose someone who betrays you, too darn bad."

Today, Soghoian observed, much third-party sharing through cell phones, social media and Internet commerce, proceeds without choice and is unnoticed — and it’s ubiquitous.

Other high-tech devices used in direct government surveillance are the Harris Stingray and Triggerfish devices which locate phone users by inviting a "ping" — a bit like the swimming pool game Marco Polo. The devices gather phone numbers, but don’t tap call content. The retro-styled machines are about the size of a shoebox, and have been around for 15 years, costing $60,000 to $175,000. In a version that can be concealed in a vest, a sleuth could go to a demonstration, for example, and gather phone numbers and, thus, the identities of the protesters.

Competing companies have sprung up in Spain, Israel and China, said Seghoian. The new news, he said, is that it has been demonstrated that people can build one for about $1,000 in off-the-shelf parts. The prospect of any snoop or gumshoe "being able to park outside a company, or a law firm with these things" should be disturbing, Seghoian said.

In the U.S., new technology is often used first and regulated second. One panelist noted that in Switzerland, it’s the opposite, and law enforcement is required to refrain from using new surveillance technology until regulations have been formulated.

Iris Scans

It was a day for dispensing with pre-conceived notions. Jennifer Lynch, an attorney with the Electronic Frontier Foundation, discussed the field of biometrics — identification through body parts, be they fingerprints, iris scans or DNA.

Rolling an ink-stained finger over paper or taking a cheek swab for DNA involve a person’s conscious participation. However, Lynch reported, the technology for making iris scans of a person’s eye can now be done with some telescopes from 1,000 meters away. Not all technology is replicating spy movies, Lynch noted. Although facial recognition software is improving rapidly, " It’s very good at identifying a person standing in front of a white wall facing straight on to the camera. It’s not good at comparing that person with a person in a crowd photo."

In the final segment, Nabiha Syed, a lawyer and former First Amendment fellow for the New York Times, explained the growing commercial pressure to allow Federal Aviation Administration licensing of unmanned drones for peaceful business purposes. She used the example of eye-in-the-sky news helicopters, pioneered in 1958, as the precursor of helicopters in urban law enforcement. The private sector, she noted, may be the leading edge for government surveillance expansion.

No other surveillance technology has gripped the public consciousness the way drones have, said Catherine Crump, an attorney for the ACLU’s Speech, Privacy and Technology Project. She said it was surprising that the latest Republican Party platform included a position limiting the use of drones, and that Tea Party activists were among the first to call for a warrant requirement for domestic drone searches.

The controversy makes for strange bedfellows, Crump concluded, but it may be the pivotal issue that could prompt congressional interest in placing new limits on government data tracking.•

The all-day Yale seminar on technology and privacy issues can be viewed in streaming video at www.yaleisp.org/event/location-tracking-and-biometrics-conference.