Legality questioned of mass-surveillance tool that warrantlessly  tracks US citizens and their 'patterns of life'

The cellphone tracking tool Fog Reveal has been utilized by law enforcement agencies across the U.S. to track American citizens and study their movement. The tool — to which access is secured by way of subscription — helps investigators and others bypass cellphone companies and internet service providers when seeking users' historical GPS data. Fog Reveal has also been used to track citizens without search warrants, prompting some to question whether it violates the Fourth Amendment.

Fog Data Science is a Virginia-based company founded by Robert Liscouski, the former head of the Department of Homeland Security's National Cyber Security Division. The company buys geolocation data collected by a variety of cellphone apps such as Waze, Tinder, or Starbucks and time-stamped through wifi, Bluetooth, and cell towers. It visually renders this data intelligible and accessible to subscribers via its Fog Reveal interface, on which members of law enforcement and private-sector clients can search a mobile device's location data by time and place.

The third-party apps installed on phones by users are critical to the data capture. According to company documents acquired by the Electronic Frontier Foundation (EFF) through Freedom of Information Act requests, "Based on each mobile device manufacturer's operating system configuration and the user's security settings, these apps can continuously broadcast the [Advertisement Identification Number] and location information for these mobile devices."

Following devices through their advertising IDs (AINs) rather than the users' names, Fog Reveal can pinpoint a device as well as historically detail a person's routine or "pattern of life." A given target's links to other individuals, places, and devices can also be established using this tool.

The Chino Police Department, for instance, used the tool to determine, through the process of elimination and investigation, which mobile device belonged to a particular suspect. They subsequently ascertained where the suspect was before the commission of an alleged crime and where he traveled to after the fact.

Fog Data Science has access to 250 million digital devices in the U.S. monthly, 15 billion signals collected daily, and the ability to mine data pertaining to patterns of life reaching back two years.

Fog Data's "investigative process" consists of four steps:

• "Enter the address, date and time of the incident, and then search";
• "Review the results of signals displaying what Smart Devices are present";
• "Run a 180 day pattern of life on Smart Devices of interest"; and
• "Identify the Smart Devices 'bed-downs' or other locations of interest."

Just as the company does not require police officers to obtain a warrant or other court order to acquire this data, many police departments reportedly do not require their officers to get a warrant.

The EEF suggested that this data capture and utilization is illegal, citing the 2018 case Carpenter v. United States, where "the U.S. Supreme Court ruled that the Fourth Amendment requires police to get a warrant before seizing historical location data, called 'cell site location information,' from phone companies."

Accordingly, the seizure and warrantless purchase of Americans' location data would similarly run afoul of the Constitution.

It is not entirely clear, however, whether Fog's quasi-anonymous mass-collection of data constitutes a violation, especially in light of the high court's narrow ruling.

The Fourth Amendment is not the only thing that this surveillance tool might violate, argued the EEF's Matthew Guariglia. The warrantless acquisition of data from Fog Data Science may constitute a First Amendment violation, granted the state's surveillance and individuated tracking of Americans could be used to identify protesters and serve to discourage people from attending constitutionally protected events.

The tool has already been used by the FBI and state intelligence officials in Iowa in their investigation of potential participants in the January 6 Capitol protests.

Beyond protests, police can use Fog Reveal to warrantlessly track law-abiding citizens to and from gun stores, mental health facilities, churches, and synagogues. Guariglia suggested it could also be used by the state to flush out whistleblowers or surveil journalists.

Arkansas prosecutor Kevin Metcalf told the AP that Fog was used successfully to make an arrest in 25-year-old Sydney Sutherland's rape and murder case in 2020.

Requiring search warrants to use Fog and similar technologies, according to Metcalf, would be a concession to the "cult of privacy." Metcalf suggested that if Americans are willing to use the free technology and apps by which they are tracked, they cannot also assert "'I'm a private person, so you can't look at any of that.' That just seems crazy."

The EEF stressed that if you have third-party applications on your smartphone and there's a possibility you have conferred any of them access to your location data over the past several years, then Fog has likely has access to your data. Although you might remain on the National Security Agency's radar, by disabling ad tracking and the mobile ad identifier on your phone, you might be able to deny Fog some insights into your pattern of life.