Law professor Andrew Guthrie Ferguson is an expert on data, surveillance and the Fourth Amendment, which protects citizens against unreasonable searches and seizures. His new book Your Data Will Be Used Against You: Policing in the Age of Self-Surveillance reveals the shocking ways law enforcement can mine virtually any data about citizens from doorbell and automated license plate reader cameras, connected cars, apps, Google searches and other digital tools that are now widely used.

Ferguson writes that the law has not caught up to what the digital world makes possible, leaving citizens at risk and arguably exposing them to massive Fourth Amendment violations. In a wide-ranging conversation, Ferguson discussed how an upcoming Supreme Court case could limit what data police can dig up showing individuals’ locations, why the founders would be alarmed by the way law enforcement treats data and how one man’s smart pacemaker data landed him in jail.

This interview has been edited for length and clarity.

Recorded Future News: In your book you say that in a world where everything is data, everything is evidence. 

Andrew Ferguson: Yes, the power balance, or imbalance, between ordinary citizens and police has drastically changed with new technologies. On the one hand is just the scale and scope and aggregation of data, but on the other, we haven't had countervailing legal protections, whether it's constitutional Fourth Amendment protections or statutory protections, to respond to this growth of data. We are essentially building a network of surveillance sensors all around us, but not building the legal protections that might balance out when police can use that data and when they can't.

RFN: One of the striking things about the legal landscape is how few court rulings there have been weighing in on how digital data should be treated and how far law enforcement can go. There are two cases that come to mind that have set some precedent, Carpenter and Jones, which you discuss in your book, and maybe you can explain a little bit here. 

AF: The Fourth Amendment and the protections that we all have against unreasonable searches and seizures remains fairly analog. It really hasn't been updated to a digital age… The exceptions that you just mentioned of United States vs. Jones and Carpenter vs. the United States involved the tracking of individuals. Carpenter involved tracking by a cell phone, and what the Supreme Court did say there was that long-term aggregated tracking of your cell phone does require a warrant. Now, just to be clear, that means that with a warrant police can track you wherever you go with your smartphone, but at least they're required to get a warrant. 

And Jones said the same thing. In order to put a GPS tracking device on your car, police need a warrant. Again, if police have a warrant, which is not that hard to get, they can put a GPS tracking device on your car and or get any of the other tracking devices that exist for tracking most modern cars because they're so well connected.

RFN: And many people don't know the extent of the powers law enforcement has. I wrote about how police were able to find a rape suspect by asking Google to search for who googled the victim's address. 

AF: One of the most shocking things for me in writing this book, even though I am somewhat of an expert on it, is that the reality is there is no piece of information, no data in your life, that is too private, that cannot be obtained with a warrant.

RFN: What do you say to those who argue that these digital tools are worthwhile because they solve crimes?

AF: Let me give you an example. I think we can all agree that having a smart pacemaker that lives in your heart and tracks your health is a benefit. And that smart pacemaker that's tracking your heart health goes to you and goes to your doctor. There's a case discussed in the book where detectives went to the doctor's office and got the data from the gentleman's smart pacemaker, his heartbeat, to use against him in a criminal case. Why? Well, the guy was actually accused of insurance fraud. He was faking an arson to get the insurance money, and the detectives weren't wrong to want to investigate that case. That makes perfect sense. But at the same time, the idea that your heartbeat that you need to live can be used as evidence against you is what is complicated, and what this book is actually trying to wrestle with is those complications. 

RFN: Let's talk about geolocation. I'm interested in how law enforcement can geolocate people driving to and arriving at abortion clinics, or really to any other location.

AF: Geolocation data is a very important issue right now because the Supreme Court is going to hear a case on geolocation data this April, the Chatrie case. For many years, Google was collecting everyone's geolocation data. If you're on any kind of Google enabled app — Gmail, Google Maps, whatever it is you were in — [data went to] what they called the Sensorvault, which is basically a collection of 500 million plus locations where everyone was essentially at almost every time. This Sensorvault was incredibly valuable and helpful for law enforcement that could, with a warrant, obtain evidence. And so in the case that's now going before the Supreme Court, the question was whether police could obtain all of the cell phone signals around a bank that was robbed, with the thought being that one of those people whose cell phone was located there was probably the bank robber. 

The Chatrie decision is not just going to [set precedent on] geolocation. It's really going to be any of these collections of information that are revealing in the same way that location data is revealing.

RFN: And with these warrants, you point out in the book that magistrate judges who are, in many cases, quite inexperienced and perhaps not who you would want deciding this question, are the ones ruling? 

AF: In the Chatrie case, the judge who signed off on this warrant that now is going before the Supreme Court had just graduated from college, hadn't gone to law school, had just finished his training to be a judge, and he is a person who is supposedly protective of all of our constitutional rights against these digital powers. 

RFN: Do you have a prediction on how they will rule?

AF: My prediction is that the court will probably take the half measure and say that a warrant is required and that some protection will be provided. But again, warrants are not that protective if you are in a state that has essentially criminalized abortion, and the attorney general can use the criminal predicates that they want to go after who's going to an abortion clinic, or even an out of state abortion clinic. Well, they have the criminal predicate. They could get a warrant. And so it's not going to be that protective because of the way we can quite easily criminalize things.

RFN: Recently a Super Bowl ad for Ring doorbell cameras sparked a huge backlash. As you know, the ad was ostensibly about finding lost dogs, but mainstream consumers, including many who do not normally think about privacy and surveillance, freaked out because they deduced that the same technology could be used against humans. 

AF: After the Super Bowl ad, after the public backlash, they have essentially walked away from this as a product. But I think the takeaway should be pretty clear to people that when you are building self-surveillance systems inside your home or outside your home, you are creating data that other entities can get access to and might very well decide to use against you or your neighbors.

RFN: Your book also talks about how Ring partners with local police to fuel the sharing of doorbell camera videos with law enforcement. You wrote that more than 2,350 police departments have partnered with Ring to promote these partnerships. 

AF: Ring, which is owned by Amazon, has recognized that part of what they can sell is surveillance as a service… The next iteration of this evolution is that they also offer you the ability to link your camera directly to a real time crime center, essentially picture a command center in your local town or city that has thousands of camera feeds going into it, such that police can essentially click a button and turn on your camera feed, or any of the camera feeds in the neighborhood.

RFN: In the aftermath of the Super Bowl backlash, Ring notably ended its partnership with Flock Safety, the automated license plate reader company, which has become controversial. One of the especially striking aspects of Flock’s system is how it allows police anywhere to search its database of other jurisdictions nationwide for cars. 

AF: Flock began with the idea of selling automated license plate reader cameras, which basically is giving an AI-enabled camera a picture of the license plate and then connecting that license plate with all of the database information you might have about who owns that car. Now they have this back end data storage and analytics that allows you to do more with it and find out more information, social network analysis and connections in other ways. 

RFN: They've also begun tracking patterns for where vehicles travel, flagging for police what they call suspicious movements. 

AF: We're talking about millions and millions and millions of cars, including your car. And what you can do with artificial intelligence is you can also track patterns, so you can see where cars have driven. What the police can do now is to take these patterns of movement and put them into an algorithm to see if any of them are “suspicious.” Now, what suspicious means is an open question, but we have seen investigations begin because a license plate has been flagged as being suspicious, and then police stop the car, on a pretext, maybe for some speeding, whatever it be, and then they do their investigation to build upon that initial flagging.

RFN: Law enforcement can buy data showing precise geolocation and suspect Google searches and more. This is data that police would have needed a warrant to access in the past. A bipartisan group of federal lawmakers had introduced the Fourth Amendment Is Not For Sale Act to combat this trend, but it failed to pass. 

AF: Because the Fourth Amendment Is Not for Sale Act has not become law, that work around of ‘we can just buy the data that otherwise we need a warrant for’ still exists and it makes much of the struggle and focus on the Fourth Amendment protections feel hollow when it is simply for sale to the — not even the highest bidder, just like a normal bidder can go buy this data and then [it can be] used against you.

RFN: An exponentially increasing number of police departments are now using drones as first responders. In New York, officials have said that use of these drones even extends to patrols. 

AF: It has become more and more the thing that departments, even small police departments, are investing in [drones] because it allows them to do more with less. And the problem, of course, is there aren't great rules yet to figure out, well, what happens with all that data you've obviously just collected — a whole scene of information — there might be concerns with some of that information. Maybe it's exculpatory… What did you do with it? How did you preserve it? How is it shared? Will there be facial recognition running on those [drone] cameras? 

RFN: The founders were deeply concerned about the possibility of arbitrary government surveillance. If that's the case, how have courts let this data surveillance go on for so long and become as extensive as it has without ruling? 

AF: In part it is because our constitutional law is still not only old-fashioned and focused on analog technologies, but also we're asking the question, which is currently the law, about whether or not something violates an expectation of privacy. And what is an expectation of privacy in a world of cameras and sensors and always-on automated license plate readers? I think a better question to ask is, is this technology allowing police to rummage through our lives? The harm that motivated the Fourth Amendment was a concern over British customs agents rummaging in your house and going through your papers and seeing what you're writing. Rummaging into your storage bins to see if you're paying taxes or not. All of these harms are about government power. 

If you ask the question, are automated license plate readers that can read every license plate anywhere, for any reason, a form of rummaging, you'd say, yeah. If you had asked yourself, are pole cameras that are watching a home for 18 months to see what you might be doing a form of rummaging into your life? Yes, they are.