Privacy advocates jaws dropped today as they read a New York Times report that cell phone companies processed more than 1.2 million law enforcement requests for customer records last year.
The disclosures came in response to letters from Rep. Edward Markey (D-MA) and Rep. Joe Barton (R-TX).
If that 1.2 million number sounds high to you, consider this: Sprint noted in its response that it received about 500,000 subpoenas last year and that “each subpoena typically requested subscriber information on multiple subscribers.”
Other carriers said they sometimes respond to subpoenas by providing all of the information from a cell tower or a particular area, thus giving police sensitive personal information on people the police haven't even asked about.
"Everyone whose phone has been used by a particular cell tower over a particular time period — likely hundreds or thousands of people — could have their data examined by investigators," said Chris Calabrese, an attorney with the American Civil Liberties Union (ACLU).
And these dragnet data requests are on the rise, Calabrese noted. Verizon estimates that over the last 5 years it has seen an average increase of 15% annually, and T-Mobile reported increases of approximately 12%-16%. This has also led to at least some possible abuse; T-Mobile disclosed that in the last three years it has referred two inappropriate law enforcement requests to the FBI.
Although they charge to fulfill the requests, the phone companies are not happy about it, noting that they must devote hundreds of employees to doing nothing but answering requests from law enforcement agencies.
"There is no statute that directly addresses the provision of location data of a mobile device to the government," a Sprint executive said in the company's response to Markey and Barton. "Given the importance of this issue and the competing and at times contradictory legal standards, Sprint believes that Congress should clarify the legal requirements for disclosure of all types of location information to law enforcement personnel."
There are two bipartisan bills -- both called the GPS Act -- in Congress that would do just that, Calabrese noted, by requiring law enforcement to secure a warrant based on probable cause before obtaining location information.