Subscribe
Share
Share
Embed
Tom Eston and Scott Wright break down the Supreme Court’s geofence warrant/location privacy ruling and explain why everyday phone users should review how apps, platforms, and data brokers collect and store location data.
Shared Security is the the longest-running cybersecurity and privacy podcast where industry veterans Tom Eston, Scott Wright, and Kevin Tackett break down the week’s security WTF moments, privacy fails, human mistakes, and “why is this still a problem?” stories — with humor, honesty, and hard-earned real-world experience. Whether you’re a security pro, a privacy advocate, or just here to hear Kevin yell about vendor nonsense, this podcast delivers insights you’ll actually use — and laughs you probably need. Real security talk from people who’ve lived it.
Supreme Court Privacy Bombshell
---
Tom Eston: This week on Shared Security, the US Supreme Court says constitutional privacy protections apply to cellphone location history and geofence warrant data. Now, the case Chatri versus United States came from a Virginia bank robbery investigation where police used a geofence warrant to ask Google for information about devices near the bank at the time of the crime.
Now, the big privacy question is whether people lose Fourth Amendment protection just because their phone's location history is stored by a company like Google. So we're gonna talk about what geofence warrants are, why this ruling matters for everyday phone users, and what you can do to reduce your location data footprint.
And joining me for this conversation is my co-host, Mr. Scott Wright
Scott: Hi folks
Tom Eston: Hello. Hello. How are you doing, Scott?
Scott: Oh, not too bad. Too bad.
Holiday Banter and Court Rush
---
Scott: It's, uh, coming up to, uh... Well, yesterday was Canada Day,
Tom Eston: Oh, yes. Happy Canada Day to you
Scott: and, uh, happy July 4th or 4th of, I guess that's 4th of July you have to call it, right?
Tom Eston: Yes.
Scott: last year
Tom Eston: Yes, 4th of July is, is coming up here this weekend, so I think most most people in the US have tomorrow, which is Friday, off, I think
Scott: going to the state fair, so
Tom Eston: Yeah, it's the 250th anniversary of the country, which is, Saturday. And so there are a lot of, I think, festivities happening, or not, just depending on where you live in the United States.
so that's kind of going on.
Scott: Yep.
Tom Eston: to hear other US citizens and their take on the 250th anniversary. Some people really care about this, and then others really don't care. but I don't know.
Scott: Yeah
Tom Eston: Your mileage may vary.
Geofence Warrant Case Explained
---
Tom Eston: so before all of this holiday stuff, the Supreme Court here in, in the United States has been busy issuing a lot of, lot of rulings because they're going to be on, I think, summer recess, essentially.
So there's been a lot of these decisions made in the last couple days, and one of them was this, decision around location tracking, which think is appropriate given that we've had this conversation several times on the podcast before about not just what regular users should be doing with , how to better secure their location information through settings on, say, your phone.
But now in the US, this case happened was there was a bank robbery in Virginia, and the local police had asked Google to give the location of everyone in the vicinity of that bank, and to see if they can catch the person that that did this robbery and did this crime. Well, that ended up going to a lower circuit court, which basically had said this information is protected, essentially.
It's considered personal data. And there wasn't a really strong ruling on that one way or another, and then it ended up in the Supreme Court. And the Supreme Court issued a ruling just this week saying that it is protected data, and in fact, it is considered, just like everything else on your phone, um, the intention is for it to be protected and not to be shown to the entire world.
now of course there is limits to that, and I think that this is actually going back to the lower court for more refinement on this particular judgment. But it does now set a precedence, I think, with, police and law enforcement asking for this information Which is called a geofence warrant, which is just give me all the data for everybody around this location, which could be thousands and thousands of people,
Scott: Yeah
Tom Eston: innocent people, if you're looking for one person in particular.
and I think that's really what this ruling is about
Fourth Amendment in the Phone Era
---
Scott: Yeah, I think, and I'm not an American, so I don't claim to know everything about amendments and I had to look it up.
Tom Eston: Yeah.
Scott: Amendment, you know,
is, uh, originally, I guess, designed to, uh, prevent, you know, unreasonable search and seizure, right?
Tom Eston: That's right
Scott: wording. And of course, smartphones weren't around when that was drafted, it goes to the point of how much should the government have to prove before they gain access to highly personal information or assets of, of
innocent people, right? And so putting this in the information age, I think it's maybe the, maybe some of the law enforcement and, and other people think it's gonna really set things back. But in, in some ways, I think it's going back to the, basis of the actual amendment itself, right? What was the intent
Tom Eston: Yeah, that's exactly right, and I think that's where we're starting to see a lot of these, these rulings starting to come out because to your point, when the Fourth Amendment was an amendment and it was put in place, you know, this technology did not exist. And so these... I don't think... It's just kinda like the, the founders of this country and the US never envisioned everyone would be walking around with a supercomputer in their, in their pockets sharing location and being able to do all these things.
And so now it's an interpretation of these courts to reinterpret these amendments and these laws, right, for modern day, and I think that is really challenging.
Canada View on Geofencing
---
Tom Eston: Even outside of the United States, and I'm interested, from a Canadian perspective, I mean, I know there is, privacy protections for Canadian citizens.
How, h- what's your thoughts on that
from, from your...
Scott: Amendment, so anything
goes really,
Tom Eston: Well, you know.
it's, it's, it's YOLO. Yeah. Yeah
Scott: No, uh, I, I mean, clearly the, the law enforcement, um, would love to have that same ability to do that sort of geofencing warrant. Um, I have not personally heard of any, uh, instances where that issue has really been, uh, brought up. But I can say that it's very likely that, you know, the, there is tension going on right now between the law enforcement agencies and the privacy commissioner and, you know, the general public about l- letting this of activity, uh, take place.
So I don't think it's, it's gone as far. I, I could be wrong, but in Canada, I don't think that, uh, law enforcement is doing that. But w- we'd, I'd have to check,
Tom Eston: Yeah.
Scott: to you on that.
Tom Eston:
Google Stops Geofence Requests
---
Tom Eston: I think it's interesting too, and, and we'll link this in the show notes, the EFF did a really good article with an overview of the whole situation and, you know, where this is, is... this ruling came from and some of the history. And it's important to note too that, like, Google has already stopped doing, the geo-fenced warrants.
Like, if they get a request from law enforcement, they just don't do it, um, because of the concern around, well, this has become a large dragnet and you're potentially putting thousands of people and their data now into this dragnet, and they had basically just said, "We're just not doing it." And I think they were waiting for this ruling to essentially confirm that we don't have to do this anymore if we do get these requests.
Scott: I see, yeah
Tom Eston: and Google's obviously the biggest. I mean, this could be any giant, giant tech company, large- or even a smaller tech company, right?
Location Data Beyond Police
---
Tom Eston: If you're thinking about, think about how much your apps in your phone is sharing your location
Scott: Yeah
Tom Eston: by the seconds. And it's not just cellphone towers.
We're also talking about all these apps. We're talking about the third parties involved with these apps, and we've had that conversation about data brokers on this podcast many times. And your location data is also wrapped up in all of that. So i- in my eyes, this goes beyond, I think, just law enforcement concerns.
This is also a reminder for all of us, I think, is to be very careful of how we share our location, and we all should be doing some type of activity to ensure that we're not giving our location away. and if you are, you know about those risks and you have kind of gone back to your own threat model around that.
Scott: I, I think that's, that's a good way to put it.
App Permissions and Informed Consent
---
Scott: I also was thinking about it in terms of, you know, privacy laws and regulations usually talk about informed consent, right? So you, you get a notice that says, "You may be tracked. Uh, do you still want to do this?" Yes, I'll
opt in, right? But often, even if we're given the notice, we don't really read it, or we don't, you know, take much, uh, notice of what it actually means.
And so I think most common ones are Waze. You know, like when you're doing your, uh, navigation every day, Waze is tracking everywhere you go, and quite often, if you don't have the right setting on, Waze will be saying, um, you know, "You should really have al- always on location
Tom Eston: Yeah
Scott: can be more, more accurate," right? And what you should really be using, I think, is, you know, while using the app, right?
Tom Eston: That's right
Scott: so when, when you do that, that's in your location services. At, at least
on an iPhone, you can turn that, uh, for specific apps, you can turn it on and off, right?
Tom Eston: Yeah. That's actually one of the big, tips that I also wanted to share with, with our listeners, is that that setting alone can really help limit the sharing of your location so it's not always on, is I also have that setting for my apps is it's only... I'm only sharing my location when I'm using the app, and it's not a continuous thing.
Scott: Another
Tom Eston: I think that's important.
Weather Apps and Ad Tracking
---
Scott: is, uh, weather apps, right? 'Cause it, uh, often
Tom Eston: Yeah
Scott: you are. Uh, but I think a lot of them are sometimes questionable in terms of how they use that data
Tom Eston: Yes, and there have been many instances of these weather apps, of course, the ones that are free, they are all tied to ads and ad networks. And, if you open up those apps, it's interesting to see a lot of those ads are tailored to, guess what? Your location.
Scott: Yep.
Tom Eston: You
Scott: Yep
Tom Eston: fast food ads of a new fast food restaurant opening up down the street from you.
Like, well, where did that come from? That's interesting. Well, the weather app has to know where you are at to give you the weather, but it's also sending that information to third parties. And then this gets back into reading those privacy policies, right? And the terms of service and, and understanding, okay, where is my data going?
Because they don't tell you that. You just get the nice email that says, "Hey guys, we've made changes to our privacy policy. Please read them." And then nobody ever reads them, and so we don't really know where our data is going.
Scott: Yeah, and the other thing that you mentioned too is important is the threat model, right? I mean, if, if you are someone who is likely to be targeted perhaps, you know, for that, you know, for being tracked or whatever, you know, then you may want to be careful about, you know, what your phone is doing or where you even go, you know, while
Tom Eston: Yeah.
Scott: is, is on
Tom Eston: Yeah, exactly.
Dashboards Delete and Limit Tracking
---
Tom Eston: And so a couple other things just to mention too, and so we've already mentioned Google,
The good thing is that they actually have a really good dashboard, uh, they call it, I think they call it, like, a privacy dashboard, where you can see all of your location history, you can see how Google is using your data. And I always recommend everybody to log in and to review that information on a periodic basis.
And you can actually go in and delete your history. You can actually turn location history stor- storage off. You can make all of those setting changes. And that's the same thing I would say for if you're a big user of Meta apps or any of these big tech companies. They all have these dashboards now where you can either delete your data or see what's being stored by them, and then taking action on that.
so deleting old location history when appropriate, just understanding how your location data is being used on a per app basis, and then limiting the number of apps that you are using that are sharing your location. occasionally there's these apps that you're like, when you install it, and it'll actually tell you, and this is the same thing on Android, right?
Like, it's going to do these certain things. Like sometimes it's like, "Connect to all the Bluetooth devices in your house, connect to the local network, and share your location." And you're like, "Why does this calculator app need my location?" Right? Like
Scott: Yep. Yeah
Tom Eston: you need to ask those questions, right? When you're seeing these, pop-ups when you install the app, and deny where appropriate.
Wrap Up Key Takeaways
---
Tom Eston: Well, hopefully everybody got a little bit of advice out of that and a little more understanding about, uh, location sharing. Like I said, we've talked about this topic many times. I think it's a, a good reminder of maybe a couple of our previous episodes we'll link in the show notes for you if you wanna deep dive a little bit more into this.
And I'm always surprised that even if we've talked about this topic three, four years ago, how relevant it still is today and has not changed much.
Scott: on our socials as well, right?
Tom Eston: They do. They definitely do. So I think that's all we have time for today, Scott.
Scott: Yep. And
Tom Eston: But
Scott: know, keep, keep your eye on the, the legislations and the
Tom Eston: Yeah
Scott: those legislation decisions, right? Um, so yeah.
Tom Eston: That's right.
Final Reminder and Sign Off
---
Tom Eston: And don't forget to review your phone's location history settings and those app permissions. well, thanks for listening everyone, and until next time, stay safe, stay secure, and stay private