- Volume 67, Issue 3
- Page 677
Note
Privacy in the Cloud
The Mosaic Theory and the Stored Communications Act
Gabriel R. Schlabach
In United States v. Jones, the Supreme Court held that the Fourth Amendment prohibits the government from installing GPS devices on suspects’ cars without a warrant. Although the majority limited its holding to the physical installation of such devices, five concurring Justices (including Justice Sotomayor, who joined the majority opinion) indicated their desire for broader privacy protections by endorsing the adoption of the “mosaic theory.” Under this theory, certain types of long-term (or otherwise expansive) surveillance violate a suspect’s reasonable expectation of privacy, even when each individual act of surveillance would otherwise pass Fourth Amendment muster, because the government can analyze the information in the aggregate to infer private details about the suspect that no individual member of the public could reasonably discover by observing her for a short time.
While Jones was limited to GPS tracking, mosaic theory concerns logically extend to a much wider range of new technologies. In recent years, telephone and Internet service providers have amassed extensive (and growing) amounts of data about their customers—more than enough to construct revealing mosaics of these individuals’ lives. But under the Stored Communications Act, a component of the Electronic Communications Privacy Act of 1986, the government may order such companies to turn over customers’ records using only a court order or an administrative subpoena—less than the warrant and probable cause requirements of a typical Fourth Amendment search.
Responding to such increasing threats to privacy, this Note proposes an amendment to the Stored Communications Act that would incorporate the mosaic theory into the statute. Under this proposal, government requests for the contents of communications as well as requests for expansive amounts of “noncontent” metadata would require a warrant and probable cause. Targeted and limited requests for noncontent data, however, would remain governed by the Stored Communications Act’s current requirements. These changes would address the concerns articulated by the mosaic theory while improving the statute’s ability to address future technological change.