The Kelsey Smith Act Would Force Cell Providers to Turn Private User Data Over to Law Enforcement

Tragedies often bring political proposals that would do more harm than help—undermining our right to secure communications, for example, or our right to gather online. It is in these moments we face legislative gambits that are too often willing to trade our privacy for assumed security. It is in these moments that we should be careful about what could be taken from us.

The Kelsey Smith Act (H.R. 5983) tries to correct a tragedy that occurred a decade ago by expanding government surveillance authorities. It is a mis-correction.

The bill would force cell phone companies to disclose the location of a person’s device at the request of police who believe that person is in distress. On its face, that’s not unreasonable. But if the police make a mistake—or abuse their power—the bill offers almost no legal recourse for someone whose location privacy was wrongfully invaded.

As the Supreme Court recently recognized in Carpenter, cell phone location information is incredibly sensitive data. It provides “an intimate window into a person’s life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations.’ These location records “hold for many Americans the ‘privacies of life.’”

With this in mind, any legislative attempt to intrude on this private data must be done extremely carefully. The Kelsey Smith Act fails to do that.

History of the Kelsey Smith Act

The first version of the bill came after the 2007 kidnapping of 17-year-old Overland Park, Kansas resident Kelsey Smith. After Smith had been reported missing, police asked Verizon to disclose the location of her cell phone. But Verizon first required the police to submit a subpoena before complying with the request (as it’s allowed to do under current law). The police eventually discovered Smith was killed the same day she was kidnapped.

Kansas lawmakers responded with a bill that traded privacy for perceived protection. Signed into state law in 2009 by the Kansas governor, similar versions of the Kelsey Smith Act have been replicated in 21 states around the country.

Today, U.S. Senators Jerry Moran and Pat Roberts and Representative Kevin Yoder believe the law should go national. The three Kansas-based lawmakers introduced the federal Kelsey Smith Act into the Senate and the House of Representatives in May, but for Rep. Yoder, this is his third attempt. His prior bills failed to pass in 2015 and 2016. (EFF opposed the 2016 bill.)

The latest Kelsey Smith Act is no better than its past iterations.

Cell Phone Providers Can Already Provide Location Information in an Emergency—Keep it That Way

Many bills and laws have their own set of emergency carve-outs—situations where the laws can be bent to respond to immediate threats that pose a serious risk of death or physical injury. But the Kelsey Smith Act turns that notion on its head, requiring disclosure when the government claims an emergency exists. And it goes too far.

Under the current bill, police could force telecommunications providers—like Verizon, Sprint, and AT&T—to disclose the location of a device simply by asserting one of two things. Police can show that the device being sought was used in the last 48 hours to call 9-1-1 to request emergency assistance, or they can show with “reasonable suspicion that the device is in the possession of an individual who is involved in an emergency situation that involves the risk of death or serious physical harm.”

To start, EFF is troubled by the bill’s expansive definition of an “emergency.” The Kelsey Smith Act allows law enforcement agents to access the location of any cell phone that has dialed 9-1-1 for emergency assistance in the last 48 hours. Almost by definition, that’s not an emergency. Emergencies are of-the-moment crises, requiring immediate responses. If you call 9-1-1 today to request emergency assistance, law enforcement shouldn’t be able to get your location information 48 hours later without showing that the call relates to a current emergency. In addition to being far too broad, this expanded definition could further deter marginalized communities from calling 9-1-1—communities that are already hesitant to seek emergency assistance from law enforcement in the first place.

Under current law, cell phone location information can already be requested by law enforcement agents from telecom companies during emergency situations. But the law allows telecom providers to have a say—they can assess what is and isn’t a real emergency and protect their users’ privacy by denying an invalid request.

The Kelsey Smith Act would effectively bar providers from protecting their users.

The potential for law enforcement agents to misuse emergency requests is more than theoretical. According to written testimony from ACLU attorney Nathan Wessler (the same attorney who argued in Carpenter), police in California, Texas, New York, and Maryland have made emergency requests for information when in fact there was no true emergency:

“Police in Anderson, California, coerced a person seeking a restraining order into saying she had been held against her will for six hours, and then sent a false emergency request for location information to the purported kidnapper’s cellular service provider.” Also, “Police in Rochester, New York, obtained location information about a suspect’s cell phone when they already knew the suspect’s location but wanted to build a better case by obtaining information from the phone.’”

Those situations involved local police fraudulently claiming life-threatening situations to obtain cell phone location information. But emergency disclosure authorities can be abused under other circumstances, like making a fake claim about national security.

In a 2010 report, the Department of Justice’s Inspector General found systemic misuse of emergency requests for call record information by the FBI. The report found that emergency requests were used in entirely non-life-threatening situations, including three “media leak investigations,” one of which resulted in the collection of telephone records from Washington Post and New York Times reporters. 

Those reporters whose privacy was wrongfully invaded were eventually told about it. No similar notification safeguards are required under the Kelsey Smith Act.

While EFF sympathizes with the bill’s intended purpose, creating an overly broad route for law enforcement to demand people’s personal information is not the answer. EFF urges Congress to reject the Kelsey Smith Act.