Cars are becoming more connected to drivers’ mobile phones, drawing call logs, text messages, location history, contact lists, driving patterns and more into the vehicle’s infotainment and navigation systems. — Dreamstime/TNS
WASHINGTON: Police can pull sensitive personal data from many modern vehicles without a warrant due to gaps in US federal law, according to new research.
Cars are becoming more connected to drivers’ mobile phones, drawing call logs, text messages, location history, contact lists, driving patterns and more into the vehicle's infotainment and navigation systems.
But while the US Supreme Court has determined that police need a warrant to search that information when it’s on a mobile phone, that protection doesn’t extend to the information when stored on a car’s systems, argued the College of William & Mary law professor Adam Gershowitz in a recent paper.
That's because of the “automobile exception” to the Fourth Amendment, which allows police to search cars without a warrant on the basis that drivers could get away in the time it takes law enforcement to get permission to search. The exception was established in a 1925 Supreme Court decision, Carroll v. United States.
It presents a potential issue for personal privacy and civil liberties, experts say, and will only get more complicated as passenger cars become more intertwined with drivers’ smartphones – and as exterior and interior cameras become more ubiquitous in vehicles.
In 2014, the Supreme Court determined police need a warrant to search mobile phones because they contain massive amounts of personal information that represent a deeper invasion than searches of wallets and other items people carry. However, the court’s ruling didn’t mention the automobile exception; at the time, vehicle technology was much more basic than it is today.
Gershowitz says if US state and federal lawmakers want to extend those protections, they should pass legislation now to protect personal data in cars before warrantless searches become widespread.
It could take decades before this issue comes before the Supreme Court, he said. In the meantime, “I think you’re gonna see a whole bunch of these searches and a lot of litigation about whether or not this is acceptable or whether it violates the Fourth Amendment.”
“That kind of lack of clarity is a real problem when there’s hundreds of millions of cars on the road,” Gershowitz said. “And each day, an old car gets replaced with new cars, and those new cars have all this technology. I think you can’t really wait for the Supreme Court to get its act together.”
Police in multiple US states already use the data stored in a vehicle’s “black box” – which records basic information on speed, braking, seat belts and air bags – to investigate crimes without a warrant. Such devices have been in common use for the past two decades.
Now a relatively new device from Maryland-based Berla Corp can withdraw much more from vehicles, including detailed call history, contacts, music preferences, social media data, text messages and more. In a podcast interview reported by the Intercept, Berla founder Ben LeMere said the company recovered such data from 70 phones after connecting to a single Ford Explorer rental car at Baltimore’s airport.
The devices can cost tens of thousands of dollars, according to Gershowitz, and require training to use, which means they’re used mostly by large police agencies that have enough resources to afford them.
But it’s likely that those searches will become more frequent given the amount of data that could be helpful for investigations: Chris Prevette, a detective sergeant with the Michigan State Police Computer Crimes Unit, told NBC News in December 2020 that four of the agency’s troopers pull data from cars for “smaller, everyday felonies” two to three times a week.
Police “still need probable cause, but they don’t need a warrant”, said Michael Bullotta, a criminal defense attorney at Bullotta Law in Detroit and a former federal prosecutor. “What’s different about this is with technology you see that there’s much more data available than normally, not just what you threw in your trunk.”
That is a red flag for civil liberties organisations that have raised concerns about invasive police searches.
“Police collection of the type of comprehensive and deeply personal data that is stored in cellphones and sometimes transmitted to automobiles through Bluetooth systems raises grave privacy and constitutional concerns,” said Phil Mayor, senior staff attorney for the ACLU of Michigan.
Mayor said the ACLU supports legislation to clarify the rules, but “in the meantime, courts can and should find that the extraction and search of such data requires a warrant – just as courts have held that searches of cellphones generally require warrants”.
Erik Gordon, a professor at the University of Michigan’s Ross School of Business, said most consumers “have very low expectations about privacy” already, but he added the information could “make or break” cases, heightening the need for constitutional clarity.
Bullotta said police having the ability to search personal data on cars without a warrant wouldn't make a significant difference: “We already have the two most powerful things in the world: DNA and cellphones. So will this be revolutionary? I don’t think so.”
He said he believes it’s likely the Supreme Court would extend the mobile phone warrant requirement to sensitive data stored on cars, but that it is unlikely lawmakers will do it before the court does.
“I don’t think it’s very common that that happens,” he said.
The question has already been raised in some states and in Congress. In 2019, the Georgia Supreme Court ruled that law enforcement must obtain warrants before pulling data from car computer systems. And in November, Sen. Ron Wyden, D-Oregon, introduced a bill that would make a warrant requirement federal law, though it has not yet come up in committee.
While automakers may have a vested interest in keeping user data secure from outside forces, they’re also looking to mine that data for their own uses, including selling it to third parties such as insurance companies or other services – though members of the Alliance for Automotive Innovation, which represents most major automakers selling vehicles in the US, have agreed to obtain consent from users before sharing information.
The Alliance and Ford Motor Co did not respond to requests for comment on whether they’re aware data can be collected from vehicles without a warrant and what the industry might do to protect against it. General Motors Co and Stellantis NV declined to comment.
“The big takeaway from all of this is that with smart vehicles, privacy is a concern and it's going to be a growing concern,” said Richard Forno, a cybersecurity professional and assistant director of the Center for Cybersecurity at the University of Maryland, Baltimore County.
“Like practically every other Internet technology we’ve seen in recent years or decades, people are going to rush in because it’s convenient and cool and shiny. And they’re not going to think too much about the consequences about what they’re trading for it.”
In the meantime, Forno has simple advice for consumers who don’t want their information to be vulnerable to such a search: “Don’t buy a Tesla” or another vehicle that draws data from your phone.
“In the technology world, regulation usually comes after the fact after there’s been a series of accidents or a major accident makes headlines. That’s the problem,” he said. “The technology advances so quickly, and the law and regulation is years, if not decades, behind.” – The Detroit News/Tribune News Service
