Privacy and the Internet of Things

By Luis Bravo

Luis Bravo is a sophomore at the University of Pennsylvania studying sociology.

You don’t have to be a political junkie to admire the Constitution, perhaps the most remarkable American achievement. Standing the test of time, the Constitution has remained intact through countless challenges. Although the Founding Fathers did not establish a perfect government, they left us with something even better- a constitutional foundation with the ability to adapt to societal problems. Needless to say, given the many advances the founding fathers simply could not have envisioned, this is a blessing. Telephones, cameras, and the Internet are just some of the many revolutionary developments that are now commonplace in our country. But while our laws and interpretations of the Constitution have been continually revised to incorporate new technology, we have reached a point in our society where technological developments are outpacing the speed at which we can create laws America’s next great constitutional challenge may soon be in every household, automobile, and even wrist! That’s right, I am referring to the Internet of Things.
       
The Internet of Things (IoT for short) refers broadly to gadgets capable of going online and collecting and exchanging data. [1] There are a plethora of IoT devices including cell phones, smart watches, and more recently even refrigerators.  “Smart devices” are a rapidly growing and becoming common in American households. [2] As the Internet of Things increases, more devices will be capable of recording user information and, consequently, reducing privacy. While for most users, the convenience of tech gadgets will outweigh privacy concerns, there is not enough legislation in place that clearly outlines the ability (or lack thereof) of the government to lawfully collect this information and utilize it in court. This issue made headlines last year after the FBI asked Apple to unlock the iPhone belonging to the gunman behind the San Bernardino shooting. In a statement, Apple refused the request by citing the customer’s privacy. Eventually, the FBI was able to crack the phone’s password through the assistance of an outside company, yet the underlying question regarding the government’s ability to obtain IoT information remains unresolved. [3]

​

This question can be conceptualized as two separate, but interrelated matters. First, it can be thought of as an issue surrounding the limitations of reasonable search and seizure. The fourth amendment clearly protects citizens and their belongings against unjustified government intrusion. Only by the permission of a warrant can people’s processions be seized. [4] As exemplified in the San Bernardino case, while the government can obtain the physical devices themselves, it does not have access to the information contained within it. The ability to access the phone’s contents and the information it collects remains with the third party company. The problem then lies on whether the information collected by the IoT devices can be reasonably seized and uncooperative companies be persecuted.

A second way to think about this issue is as a matter regarding the right to privacy. The right to privacy is a concept that has continually developed through the courts for decades but became of increased national interest after Edward Snowden released documents outlining American espionage of its citizens. [5] Though not explicit in the constitution, legal scholars and judges have pieced together a legal foundation through court precedents and constitutional amendments. [6] Under this frame, the problem centers around whether or not people have a fundamental right to privacy when utilizing their IoT devices and moreover, if there is a reasonable expectation for confidentially. This issue might be easier to resolve, however, as there appears to be an implicit assumption that some of your data might be collected; especially after signing the terms of agreement, logging in to all your online accounts, or activating GPS and other real time data services.

Though the FBI case is informally resolved, another legal battle might persuade federal judges to rule on this debate, with serious implications for the future utilization of big data in court cases. On February 2016, Arkansas authorities arrested James Bates for murder. The Benton County prosecutor later requested IoT information from Amazon that was collected by the Echo personal assistant device. [7] Because the Echo is connected to a variety of sensors throughout Bates’ home and contains microphones that record when prompted, it is possible it may have picked up evidence. Much like the FBI case, Amazon refused the request by referencing customer privacy. Though a warrant for the physical device has been issued, authorities were only able to obtain basic user information. In order to access IoT data, the prosecutor of the case would require a search warrant for Amazon that specifically references the collected information.

The question is, could and would such a warrant be issued? This would clarify doubts surrounding the government’s ability to obtain IoT information. If a warrant is indeed issued, this establishes that there is a reasonable basis to collect IoT information and creates a pathway for it to be admissible in court. This means that in future cases, the information collected by your portable devices and other electronic gadgets could be utilized against you. If the request to grant a warrant is rejected, this implicitly upholds the right to privacy by deeming the petition unreasonable.

Though the judges at the various levels will be the ultimate arbiters, how they will decide is in part based on us. Do we believe it's reasonable for authorities to be able to confiscate information collected automatically, sometimes even without our conscious consent, through IoT devices and be utilized in court? While the answer for many might be an impulsive no, it is important to weigh the benefits in increasing public safety. If your parent, significant other, or loved one was the victim of a crime and the information from an Amazon Echo would lead you to convict the perpetrator, wouldn’t you want it to be admissible as evidence in court?

With modern conveniences, a new set of problems is ushered into society. At first glance, the question of governmental access to IoT information seems trivial, even inconsequential. The larger frame, however, presents a different picture. The issuance of warrants for IoT data would allow the government greater access into our lives and an increased ability to peer into even our most embarrassing actions. Granted, this doesn’t mean we will be plunged into an Orwellian society, but we should at least consider the possibility of increasing safeguards and establishing increased checks for governmental surveillance. If used responsibly, IoT devices and the information they collect could prove useful in ensuring a safer world for all.


[1] Morgan, Jacob. “A Simple Explanation Of ‘The Internet Of Things.’” Forbes. Accessed February 2, 2017. http://www.forbes.com/sites/jacobmorgan/2014/05/13/simple-explanation-internet-things-that-anyone-can-understand/


[2] Thierer, Adam. “The Internet of Things and Wearable Technology: Addressing Privacy and Security Concerns without Derailing Innovation.” Mercatus Center, November 17, 2014. https://www.mercatus.org/publication/internet-things-and-wearable-technology-addressing-privacy-and-security-concerns-without

[3] Selyukh, Alina. “The FBI Has Successfully Unlocked The iPhone Without Apple’s Help.” NPR.org. Accessed February 2, 2017. http://www.npr.org/sections/thetwo-way/2016/03/28/472192080/the-fbi-has-successfully-unlocked-the-iphone-without-apples-help

[4] USCourts.gov. “What Does the Fourth Amendment Mean?” United States Courts. Accessed February 2, 2017. http://www.uscourts.gov/about-federal-courts/educational-resources/about-educational-outreach/activity-resources/what-does-0

[5] Mazzetti, Mark, and Michael S. Schmidt. “Edward Snowden, Ex-C.I.A. Worker, Says He Disclosed U.S. Surveillance.” The New York Times, June 9, 2013. http://www.nytimes.com/2013/06/10/us/former-cia-worker-says-he-leaked-surveillance-data.html

[6] Staff, L. I. I. “Personal Autonomy.” LII / Legal Information Institute, August 6, 2007. https://www.law.cornell.edu/wex/personal_autonomy

[7] NPR. “Amazon Echo Murder Case Renews Privacy Questions Prompted By Our Digital Footprints.” NPR.org. Accessed February 2, 2017. http://www.npr.org/2016/12/31/507670072/amazon-echo-murder-case-renews-privacy-questions-prompted-by-our-digital-footpri


The opinions and views expressed through this publication are the opinions of the designated authors and do not reflect the opinions or views of the Penn Undergraduate Law Journal, our staff, or our clients.