Privacy in the digital age: phones, data and new technology

When Desjardins started policing, the most private thing most suspects carried was a wallet. Today, Linh Tran points out, nearly every person officers meet carries a phone holding years of messages, photos, location history, banking records, medical searches and the details of every relationship they have. Desjardins agrees and says that is why courts on both sides of the border have spent the last fifteen years rewriting the law of search for the digital age. Rules designed for wallets, filing cabinets and car trunks do not fit a device that can reveal more about a person than a search of their entire home. This lesson covers how courts have adapted the Fourth Amendment to phones, computers, data held by companies and new surveillance tools.

Why digital devices are different

Courts have identified several features that make digital searches unusual. Phones and computers store an immense quantity of information, far more than any physical container. The information is intimate, revealing beliefs, health, finances and relationships. It reaches back over time, so a search can reconstruct years of a life. Much of it is not stored on the device at all but in the cloud, so looking at the phone can mean looking at data held on servers anywhere in the world. And the information is created automatically, often without the person knowing, as with location records and app logs. In Riley v. California in 2014, Chief Justice Roberts wrote for a unanimous Court that modern cell phones are not just another technological convenience: with all they contain and all they may reveal, they hold for many Americans the privacies of life. A search of a phone, he noted, would typically expose more to the government than the most exhaustive search of a house.

Searching a phone after arrest

Riley v. California held that police generally must get a warrant before searching the digital contents of a phone seized from an arrested person. Officers may seize the phone to prevent the destruction of evidence, may examine its physical aspects to make sure it cannot be used as a weapon, and may take steps such as turning off the phone or placing it in a signal-blocking bag to prevent remote wiping. Exigent circumstances can still justify a warrantless look in a genuine emergency, such as a kidnapping in progress. Otherwise, the answer to what officers should do before searching a phone is, in the Court's words, simple: get a warrant.

Marco DiSanto asks why the two countries came out differently. Desjardins explains that the courts weighed the same considerations, the intrusiveness of the search against the needs of an urgent investigation, and drew the line in slightly different places. The Court rejected a narrower rule that would have allowed searches of call logs or of areas likely to hold evidence of the crime, worrying that such rules would prove unworkable. For officers on either side, the safest habit is the same: secure the phone, prevent remote wiping, and seek a warrant.

Data held by others

Much of the information police want is held not by the suspect but by companies: phone carriers, internet providers, banks, app developers and cloud services. For decades, American courts applied the third-party doctrine: information voluntarily shared with a third party, such as bank records in United States v. Miller in 1976 or dialed phone numbers in Smith v. Maryland in 1979, carries no reasonable expectation of privacy. In Carpenter v. United States in 2018, the Supreme Court declined to extend that doctrine to historical cell-site location information, holding that police generally need a warrant to obtain seven days or more of it, because it provides an intimate window into a person's life. Federal law, especially the Stored Communications Act, also governs access to emails and stored content, generally requiring a warrant for content. Lower courts are still working out how Carpenter applies to other data, such as tower dumps and geofence warrants that ask a company for every device in an area, and federal appeals courts have reached different conclusions.

Priya asks whether police can simply buy data that companies sell to anyone. Desjardins says this is one of the most contested questions in the field. Data brokers sell location and browsing information gathered from apps, and some agencies have purchased it. Some lawmakers have proposed banning the practice, and policies vary widely between agencies and states. Officers should treat any new data source as a legal question first and a technical question second.

Surveillance technology

New tools raise the same basic question: does the technique intrude on a reasonable expectation of privacy? In Kyllo v. United States in 2001, the Supreme Court held that using a thermal imager from the street to detect heat from a home was a search, because it revealed details of the home that would previously have been unknowable without physical entry, using technology not in general public use. Jones held that attaching a GPS tracker to a car and monitoring it was a search. Wiretaps require an order under Title III of the federal Omnibus Crime Control and Safe Streets Act of 1968 or a comparable state law, with strict requirements that make them the most demanding orders in American law.

Some technologies sit in a gray area that law and policy are still sorting out. Automated license plate readers photograph every plate that passes and store the time and location. Drones can watch backyards from above. Facial recognition can match a face in a crowd to a database. Body-worn cameras record not only suspects but bystanders and the insides of homes. Some cities and states restrict facial recognition by police, and courts have begun to ask whether long-term, comprehensive tracking by these tools amounts to a search under the reasoning of Carpenter. Desjardins advises the class to learn their service's policy for each tool and to remember that the policy is a floor, not a ceiling: the Constitution still applies.

Tailoring a digital search

Even with a warrant, a digital search must stay within its authorization. Investigators increasingly use extraction tools that copy everything from a phone, but the warrant usually authorizes searching only for specific evidence, often within a time window. Detective Ana Ferreira of Port Ardent's major crime unit shows the class how investigators filter an extraction so that the review stays within the warrant. The program below represents a small extract and keeps only items within the authorized date range and categories.

# A simplified phone extraction: (day of March 2026, category, description)
items = [
    (2, "photo", "family dinner"), (9, "message", "work schedule"),
    (13, "message", "meet at the store tonight?"), (13, "photo", "street at night"),
    (14, "message", "got the stuff, 3 drills"), (14, "location", "near store 02:10"),
    (14, "browser", "medical symptoms search"), (15, "message", "how much for a drill?"),
    (20, "photo", "dog at the park"), (21, "message", "doctor appointment"),
]
# The warrant authorizes messages, photos and location from March 13 to 15 inclusive
allowed_days = range(13, 16)
allowed_categories = {"message", "photo", "location"}

in_scope = [i for i in items if i[0] in allowed_days and i[1] in allowed_categories]
print("items in extraction:", len(items))
print("items within the warrant:", len(in_scope))
for day, cat, desc in in_scope:
    print(f"  March {day}: {cat:8s} {desc}")
print("items the reviewer must not examine:", len(items) - len(in_scope))

items in extraction: 10
items within the warrant: 5
  March 13: message  meet at the store tonight?
  March 13: photo    street at night
  March 14: message  got the stuff, 3 drills
  March 14: location near store 02:10
  March 15: message  how much for a drill?
items the reviewer must not examine: 5

Of ten items, five fall within the warrant. The browser search on March 14 is inside the date range but outside the authorized categories, so the reviewer leaves it alone even though it is from the right day. Ferreira tells the class that reviewers document the filters they use, so that a court can see exactly what was examined. A reviewer who wanders through a whole phone because the extraction happens to contain everything turns a lawful warrant into an unreasonable search.

Passcodes, fingerprints and compelled access

A warrant may authorize searching a phone, but what if the phone is locked? American courts are divided on compelled decryption. Many have held that forcing a suspect to reveal a passcode is testimonial and protected by the Fifth Amendment, because it discloses the contents of the person's mind, though some courts allow it when the government already knows the information it would reveal under the foregone conclusion doctrine. Compelling a fingerprint or face to unlock a phone has been treated by several courts as non-testimonial, like taking fingerprints, but others disagree, and the Supreme Court has not resolved the question.

Linh asks why a fingerprint might be treated differently from a passcode. Desjardins explains the distinction courts draw between physical evidence, which the privilege against self-incrimination generally does not protect, and communication from the mind, which it does. A passcode is something the person knows and must reveal; a fingerprint is something the person has. Whether unlocking a phone with a finger also communicates something, such as that the person controls the phone, is exactly what courts are debating.

Social media, open sources and undercover profiles

Information that people post publicly, such as open social media profiles, public comments and photos anyone can see, generally carries little or no reasonable expectation of privacy, and police can review it like any other public source. But open-source investigation has limits. Creating fake profiles to befriend a suspect, joining private groups and collecting large volumes of data about people who are not suspects can raise privacy issues, and courts have generally allowed undercover online contacts with suspects while expecting agencies to have clear policies. Port Ardent requires supervisory approval and a written plan before any officer uses an online undercover identity.

Desjardins reminds the class that publicly available does not mean unlimited. Gathering every public post about a protest group, for example, can chill lawful expression, and privacy commissioners and courts have criticized mass collection of open-source data without a clear investigative purpose. Officers should collect what relates to a specific investigation, record why, and follow their service's policy.