Police can pull sensitive personal data from many modern vehicles without a warrant due to gaps in federal law, according to new research.
Cars are becoming more connected to drivers' mobile phones, drawing call logs, text messages, location history, contact lists, driving patterns and more into the vehicle's infotainment and navigation systems.
But while the Supreme Court has determined that police need a warrant to search that information when it's on a mobile phone, that protection doesn't extend to the information when stored on a car's systems, College of William & Mary law professor Adam Gershowitz has argued in a recent paper.
That's because of the "automobile exception" to the Fourth Amendment, which allows police to search cars without a warrant on the basis that drivers could get away in the time it takes law enforcement to get permission to search. The exception was established in a 1925 Supreme Court decision, Carroll v. United States.
It presents a potential issue for personal privacy and civil liberties, experts say, and will only get more complicated as passenger cars become more intertwined with drivers' smartphones and as exterior and interior cameras become more ubiquitous in vehicles.
In 2014, the Supreme Court determined that police need a warrant to search mobile phones because they contain extensive amounts of personal information. The ruling made no mention of cars, which at the time did not have today's elaborate technology.
Gershowitz says that if state and federal lawmakers want to extend those protections, they should pass legislation now. It could take decades before this issue comes before the Supreme Court, he said. In the meantime, "I think you're going to see a whole bunch of these searches and a lot of litigation about whether or not this is acceptable or whether it violates the Fourth Amendment."
Many police forces already use the data stored in a vehicle's "black box" — which records basic information on speed, braking, seatbelts and air bags — to investigate accidents without a warrant. Such devices have been in common use for two decades.
Now a relatively new device from Maryland-based Berla Corp. can withdraw much more from vehicles, including detailed call history, contacts, music preferences, social media data, text messages and more. Berla founder Ben LeMere said in a recent podcast that the company recovered such data from 70 phones after connecting to a single Ford Explorer rental car at Baltimore's airport.
The devices cost tens of thousands of dollars and require extensive training, according to Gershowitz, so few police forces currently have them. But as the cost comes down and its operation simplifies — as it does with most new electronic devices — that's likely to change.
More data available
Police still need probable cause to go exploring with one of the devices, "but they don't need a warrant," said Michael Bullotta, a criminal defense attorney in Detroit and a former federal prosecutor. "What's different about this is with technology you see that there's much more data available than normally, not just what you threw in your trunk."
That is a red flag for civil liberties organizations that have raised concerns about invasive police searches.
"Police collection of the type of comprehensive and deeply personal data that is stored in cellphones and sometimes transmitted to automobiles through Bluetooth systems raises grave privacy and constitutional concerns," said Phil Mayor, senior staff attorney for the ACLU of Michigan.
The question already has been raised in some states and in Congress. In 2019, the Georgia Supreme Court ruled that law enforcement must obtain warrants before pulling data from car computer systems. And in November, Sen. Ron Wyden, D-Ore., introduced a bill that would make a warrant requirement federal law, though it has not yet come up in committee.
Automakers have their own interests in mining the data, including selling information on driving patterns to insurance companies. But they're also aware that many consumers might find the practice objectionable.
"The big takeaway from all of this is that with smart vehicles, privacy is a concern and it's going to be a growing concern," said Richard Forno, a cybersecurity professional and assistant director of the Center for Cybersecurity at the University of Maryland, Baltimore County.
"Like practically every other internet technology we've seen in recent years or decades, people are going to rush in because it's convenient and cool and shiny. And they're not going to think too much about the consequences about what they're trading for it."
A time gap is inevitable, Forno said.
"In the technology world, regulation usually comes after the fact after there's been a series of accidents or a major accident makes headlines. That's the problem," he said. "The technology advances so quickly, and the law and regulation is years, if not decades, behind."
