US, Canadian courts rule against warrantless metadata collection

Court rulings delivered in the United States and Canada have backed privacy rights over law enforcement, judging that police cannot compel telcos and ISPs to hand over information on people without warrants.

Over the weekend, the Supreme Court of Canada ruled that police had violated the country's constitution by forcing an internet service provider to release information on Matthew David Spencer, without a warrant.

Spencer was convicted of possessing child pornography obtained by using an internet account in his sister's name. Police obtained information on Spencer through Shaw ISP Communications, something the Supreme Court held was a search without a warrant.

In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search. - Justice Cromwell, Supreme Court of Canada.

Last week, human rights organisation the American Civil Liberties Union (ACLU) said it had won an appeal [PDF] against the use of delivery orders to obtain phone metadata on people under surveillance, saying US police must obtain warrants for the data searches in their investigations.

While delivery orders have been used by police frequently in the past to obtain phone metadata, the ACLU said the ruling in the 11th Circuit Appeals Court "soundly repudiates the government's argument that by merely using a cell phone, people somehow surrender their privacy rights".

“There is a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship, or a house of ill repute,” the three-judge court said unanimously.

“In short, we hold that cell site location information is within the subscriber’s reasonable expectation of privacy. The obtaining of that data without a warrant is a Fourth Amendment violation,” the judges said.

Florida resident Quartavious David, suspected of being involved in several robberies, was tracked by police who obtained location records for his and suspected accomplices' phones without warrants from telcos.

Over 67 days, police obtained 11,606 location records according to documents received by the ACLU.

Davis, 18 years of age when the robberies took place, received a sentence of 162 years in prison, based largely on the phone location records. His conviction is likely to stand as police relied in good faith on a magistrate judge who issued the delivery order.

Australia allows warrantless collection of telecommunications metadata by law enforcement agencies currently.

However, there may be greater oversight across metadata collection in Australia into the future. Commonwealth Ombudsman Colin Neave - who is in charge of inspecting police records relating to use of covert powers -  said in a parliamentary hearing recently that his office would like to monitor the collection of this information.

Neave believes his office publicly reporting on whether or not law enforcement agencies used their powers lawfully could play a key role in ensuring greater accountability and transparency.