Cyber law 2013

Jeff VanDyke

The Need for Privacy Protection from Drones By Jeff VanDyke Introduction "Technology has been the primary source of military innovation throughout history"1. During times of war, there have been technological advancements, such as discovering how to harness the power of the atom2. After the Second World War, nuclear technology was harnessed and converted to a power source, which now provides 15.7 percent of the world's electricity, and has helped shape the world's view on energy3. One new technology that has come from war is drones. At the beginning of the Iraq invasion, the military only used a handful of drones 4. Today there are over 19,000 drones in use by the military, and that number continues to grow5. Like nuclear technology, drone technology is spreading, and there has been a push to create the possibility for the commercial use of drones6. Current legislation would force the Federal Aviation Administration (F.A.A.) to issue more permits, more quickly, and for broader use than it currently does7. However, the F.A.A.'s main concern is with safety, not with the other implications of introducing drones into American airspace, and with introducing drones into the everyday life of Americans8. This paper will first look at how drones are currently used by the military overseas. This paper will analyze the legal framework that is currently used with the use of those drones. Then this paper will analyze the current legal framework that would govern the

1 2

http://www.fpri.org/footnotes/1402.200902.roland.wartechnology.html http://en.wikipedia.org/wiki/Nuclear_technology 3 Id. 4 http://www.rollingstone.com/politics/news/the-rise-of-the-killer-drones-how-america-goes-to-war-in-secret20120416 5 Id. 6 https://www.aclu.org/files/assets/protectingprivacyfromaerialsurveillance.pdf at 9. 7 Id. 8 Id.

Cyber law 2013

Jeff VanDyke

use of drones and privacy, and lastly, this paper will analyze proposed legislation that is attempting to safeguard privacy protections in America. Military Use The first use of aerial surveillance by American armed forces can be traced back to the Spanish-American war, where cameras were attached to kites to produce aerial photographs9. Drone technology as we know it today, has advanced far beyond primitive cameras on kites, and has been widely used by the military since the Vietnam war10. Drones can range from large fixed wing aircraft that are roughly the size of a Boeing 747, to Hummingbird nano drones that are only 7 inches and weigh less than 11 grams11. The use of these drones ranges from military strikes, to general surveillance, as well as combat surveillance12. Currently, there is little framework that governs the use of drones by the military. Most of the framework for the use of drones involves targeted killings by the military, and assassinations by the CIA13. For CIA assassinations, when a target has been acquired, a five page dossier is put together that lays out the justification for the attack14. An Agency lawyer then reads the report, and if she determines that there is enough justification, signs off15. However, there have been few dossiers that have been rejected, so this is not much oversight16. On the side of the military, the use of drones is primarily a decision that occurs somewhere in the general command structure17. There is little known about how the

http://www.understandingempire.wordpress.com/2-0-a-brief-history-of-u-s-drones/ Id. 11 https://www.aclu.org/files/assets/protectingprivacyfromaerialsurveillance.pdf 12 Id. 13 : http://www.rollingstone.com/politics/news/the-rise-of-the-killer-drones-how-america-goes-to-war-in-secret20120416#ixzz2Ql2yhfZ6 14 Id. 15 Id. 16 Id. 17 http://fcnl.org/issues/foreign_policy/understanding_drones/

10

Cyber law 2013

Jeff VanDyke

determinations to do general surveillance is made18. However, a memorandum has been made public that shows that when the military has identified a target that is an American citizen, there is oversight to determine if the American citizen's Fifth Amendment due process rights would be violated by killing that citizen19. To get around the Fifth Amendment's due process rights, the government has to evaluate the private interest and weigh that interest against the government's interest20. The private interest is life, while the government's interest is weighed by a three prong test that must show that the American citizen poses and immediate threat, that it would not be feasible to try and capture American citizen, and that the strike is conducted according to law of war principles21. Domestic Use While the military has used drones for surveillance and for targeted killing, the civilian sector has recognized that drone technology has much broader applications in everyday American life22. Police would like to be able to use drone for surveillance purposes, and to augment police officer safety in potentially dangerous situations23. For example, a police officer in North Dakota was searching for six cows, and when he tried to execute a search warrant on a family farm, the rancher chased him off with a rifle24. The officer then called in for back up, and the police used a drone to locate the cattle on the ranch, determine that the ranchers were unarmed, and then arrested the ranchers25.

18 19

Id. Department of Justice White Paper http://msnbcmedia.msn.com/i/msnbc/sections/news/020413_DOJ_White_Paper.pdf 20 Id. 21 Id. 22 http://www.forbes.com/sites/kashmirhill/2011/12/13/the-future-of-drones-in-america/

23 24

Id. Id. 25 Id.

Cyber law 2013

Jeff VanDyke

Besides the police, first responders and firefighters would like to use drones to augment their safety, oil and gas companies would like drone to help with maintaining electrical lines and gas pipelines, farmers would like to use drones for crop dusting and to track and protect livestock, insurance companies would like to use drones to conduct house inspections, and news organizations would like to use drones to record sporting events, or to even record and broadcast news events26. There are also model aircraft users that would like to expand their interests to include drones. As more industries realize that drone technology can aid them in their respective fields, and as more people gain an interest in drones, there needs to be some sort of legal framework in place that governs the use of drones. Current Legal Framework Currently there are no laws that specifically govern the commercial use of drones, and Congress is only beginning to look into the problem27. Even though the military has been using drones since the Vietnam War, the legal framework that exists in the military cannot be adopted to introduce drones to civilian use since that framework is based primarily on the chain of command, and only requires oversight when targeted killing is involved. Currently, there is also no real domestic legal framework that can govern the commercial use of drones. Testifying before the Senate, professor Ryan Calo stated that, " There's very little in American privacy law that would limit the use of drones for surveillance"28. The only restraint on the government's use of drones is the Fourth Amendment, and the only restraint on corporations and other private actors are privacy laws and common law.29 Besides these three sources of law, the only restraint on the use of drones comes from the F.A.A., who is the
26 27

Id. http://www.nytimes.com/2013/03/21/us/politics/senate-panel-weighs-privacy-concerns-over-use-ofdrones.html?_r=0 28 Id. 29 Id.

Cyber law 2013

Jeff VanDyke

governing body that issue the permits30. However, under current law, the F.A.A. has no jurisdiction over privacy law31. What this means is that permits are currently only concerned with the safety of using drones, and don't take into account the actual purpose behind the use of the drones, or more specifically, how the use of drones will affect privacy32. Some members of Congress feel that current law and the F.A.A. issued permits are not enough to safeguard American's privacy interests33. For instance, Senator Charles E. Grassley reasoned that, "just because the government may comply with the Constitution does not mean they should be able to constantly surveil, like Big Brother"34. Senator Grassley is correct, that even when the Government is adhering to the Constitution, as the laws currently are written, there is not much protection for privacy rights in the use of drones. The Fourth Amendment does little to offer any real privacy protection from searches by the government. The leading cases for the Fourth Amendment and its implications with drones are Dow Chemical Co. v. United States, Kyllo v. United States, and California v. Ciraolo35. In California v. Ciraolo, the police had an anonymous tip that the Defendant was growing pot in his back yard36. The police did not get a warrant, and instead tried to look into the Defendant's backyard, but were ultimately unable to do so because of a large fence around the Defendant's property37. The police then went and got a small private plane and flew it about 1,000 feet above the Defendant's home38. Officers were able to identify marijuana plants, and

30 31

Id. Id. 32 Id. 33 Id. 34 Id. 35 https://www.aclu.org/files/assets/protectingprivacyfromaerialsurveillance.pdf 36 California v. Ciraolo, 476 US 207 (1986) http://scholar.google.com/scholar_case?case=13894501388713609672&q=California+v.+Ciraolo&hl=en&as_sdt=2 ,45 37 Id. 38 Id.

Cyber law 2013

Jeff VanDyke

used a standard 35mm camera to take pictures39. The Defendant claimed that his Fourth Amendment right against unreasonable searches had been violated, because the police did not have a warrant when they flew over his home and took pictures40. The Court did not agree with the Defendant, stating that it "is unreasonable for respondent to expect that his marijuana plants were constitutionally protected from being observed with the naked eye from an altitude of 1,000 feet. The Fourth Amendment simply does not require the police traveling in the public airways at this altitude to obtain a warrant in order to observe what is visible to the naked eye"41. From the Courts ruling in this case, it seems that the Government would be able to use drones to collect information without a warrant, provided that the drones flew in public airways, and only obtained data that is visible to the naked eye. At the same time the Supreme Court decided California v. Ciraolo, they also decided Dow Chemical Co. v. United States42. In this case, the EPA had made an inspection of the Defendant's site, and requested to do a second inspection43. The Defendant declined, and, instead of getting a administrative warrant, the EPA decided to hire a commercial aerial photographer to fly over the site at 12,000 feet, at 3,000 feet, and at 1,200 feet, while taking pictures44. The Court denied the Defendant's claims that the Defendant's Fourth Amendment rights had been violated, and then expanded the naked eye standard from Ciraolo to include the area immediately above, or sufficiently near the reach of cameras, and that taking aerial photographs from navigable airspace is not a search within the Fourth Amendment45. Under this case law, the Government

39 40

Id. Id. 41 Id. at 215. 42 Dow Chemical Co. v. United States, 476 US 227 (1986) http://scholar.google.com/scholar_case?case=2807189437219807369&q=Dow+Chemical+Co.&hl=en&as_sdt=2,45 43 Id. 44 Id. 45 Id at 239

Cyber law 2013

Jeff VanDyke

would be able to take photographs without the need for a warrant, as long as the drones are in legally navigable airspace. Also, the Court did not determine which types of cameras would be acceptable under this test. Drones today are fitted with high powered lenses, as well as night vision, infrared, and ultraviolet cameras46. Some drones even have see through radar, which allows drones to see through walls and ceilings to track people47. The Court stated that cameras were ok, but did not address what the limits of technology from aerial data gathering would be. The Court only hinted that the use of technology not available to the public "might" constitute a search under the Fourth Amendment48. The question of what technology can be used without violating the Fourth Amendment was addressed in Kyllo v. United States49. In Kyllo, an agent of the Department of the Interior believed that the Defendant was growing marijuana inside his home50. The agent knew that thermal lamps were used to grow marijuana indoors, so he decided to get a thermal imager to see if lamps were being used in the Defendant's home51. The thermal images came back showing what the agent believed was evidence that there were thermal lamps being used52. The Court determined that the use of thermal imaging constituted a search within the meaning of the Fourth Amendment, and that because there was no warrant, none of the evidence obtained by the agent was admissible53. The Court determined that, when technology that is not in general public use is used to gain information about the interior of a home, which information would not have been

46 47

https://www.aclu.org/files/assets/protectingprivacyfromaerialsurveillance.pdf Id. 48 Dow Chemical Co. V. United States, 476 US 227 at 238 http://scholar.google.com/scholar_case?case=2807189437219807369&q=Dow+Chemical+Co.&hl=en&as_sdt=2,45 49 Kyllo v. United States, 533 US 27 (2001) http://scholar.google.com/scholar_case?case=15840045591115721227&q=Kyllo+v.+United+States&hl=en&as_sdt =2,45 50 Id. 51 Id at 30. 52 Id. 53 Id. at 40.

Cyber law 2013

Jeff VanDyke

available any other way without going inside the home, then there has been an unreasonable search if a warrant has not been obtained prior to the search54. On one hand it would seem like this ruling would limit the Government's use of drones to just using cameras and video surveillance, but the Courts decision is centered around what technology is in general use. It is expected that tens of thousands of permits to operate drones will be issued in the coming years55. With tens of thousands of drones being operated, it could be argued that any technology that is used by those drones would be generally used. The Courts determination that the reason the search was unreasonable was because the technology was not generally used then could possibly fail in the future. As drones become more prevalent, and as technology such as cameras that use radar to see through walls becomes cheaper and more accessible, any privacy protection coming from the ruling in Kyllo v. United States disappears. Proposed Legislation With Supreme Court rulings like those in Dow Chemical Co. v. United States and California v. Ciraolo limiting Fourth Amendment protection, and with Kyllo v. United States possibly offering no protection from advances in technology, experts worry that the erosion of American privacy will come largely from the government's use of drones, and not necessarily for the commercial use of drones56. However, Representative Barton, Republican of Texas, and Representative Markey, Democrat of Massachusetts, believe that the harm that can come from both the private sector and from the Government must be addressed57. To address these concerns,
54 55

Id. http://markey.house.gov/press-release/markey-drone-privacy-legislation-prevent-flying-robots-becomingspying-robots 56 http://www.nytimes.com/2013/03/21/us/politics/senate-panel-weighs-privacy-concerns-over-use-ofdrones.html?_r=0 If its my neighbor that wants to snoop on me, he cant put me in jail, said Elizabeth Goitein.If Google or Amazon wants to use drone surveillance to figure out my market preferences, the worst thing that happens is I get marketed stuff I dont need. 57 http://markey.house.gov/press-release/markey-drone-privacy-legislation-prevent-flying-robots-becomingspying-robots

Cyber law 2013

Jeff VanDyke

Mr. Markey and Mr. Barton have introduced a bill in the House titled the "Drone Aircraft Privacy and Transparency Act of 2013"58. Under the Act, the F.A.A. Modernization and Reform Act of 2012 would be amended59. The amendments would force the Secretary of Transportation, Secretary of Commerce, Chairman of the Federal Trade Commission, and the Chief Privacy Officer of the Department of Homeland Security to do a study that identifies any potential threats to privacy protections from the integration of drones into United States airspace60. Privacy protections is defined in the act as protections that relate to the use, collection, and disclosure of information and data about individuals and groups of individuals61. This has very broad implications since the report is not just limited to video or photographic surveillance concerns, but to all data about an individual that can be compiled through the use of drones. The F.A.A. then must use the report to ensure that any final rule adopted under the Act will ensure that the integration of drones is done in compliance with privacy principles62. The Act goes on to grant drone operators the ability to collect data, but the operator must include in the permit a data collection statement that provides reasonable assurance that the applicant will operate the drone in accordance with the established privacy principles63. If the permit is being issued to law enforcement, then the data collection statement has to include a minimization statement, which would ensure that the collected data is restricted to a certain type of data, and that other unintended data will be minimized64. Data minimization must ensure that
58

Drone Aircraft Privacy and Transparency Act of 2013 H. 6676, 113 Cong., Ist Sess. (2013). http://markey.house.gov/sites/markey.house.gov/files/documents/3.19.13_DroneAircraftPrivacyTransparencyAct 2013.pdf 59 Id 60 Id. at Sec. 337 61 Id. 62 Id. 63 Id. at Sec. 339 64 Id.

Cyber law 2013

Jeff VanDyke

information not related to the specific purpose of the investigation is destroyed, and must ensure that data will be destroyed once it is no longer pertinent to the ongoing investigation65 The data collection statement must include who is able to operate the drone, the specific location of where the drone will be operating, the maximum duration of the drone's flight, and if the drone is collecting data about individuals or groups66. If the drone is collecting information about individuals or groups, the statement must include the circumstances under which the system is being used, the specific kinds of information that is being collected about the individuals or groups, how the data is going to be used, and even goes on to include how conclusions drawn from the data is going to be used67. The statement must also specify how the data will be disclose, how it will be collected or retained, how data unrelated to the specified use will be minimized, if any of the data is going to be sold, leased, or made accessible to a third party, how the individuals being observed will have their privacy affected by the use, and specific steps about how the operator of the drone is going to mitigate any identified impact to the privacy of those that are observed68. The statement must also state methods that the operator is using to protect the information being collected from disclosure, as well as a telephone number that individuals can use to complain about the drones and to confirm that information is being collected about them69. If the individual requests the information that is being collected, the operator of the drone must either comply with the request, or give reasons why the request is being denied70. There also

65 66

Id. Id. 67 Id. 68 Id. 69 Id. 70 Id.

10

Cyber law 2013

Jeff VanDyke

must be a process, where the individual can correct wrong information, or have the false information erased71. Under the Act, the F.A.A. is required to make all of the information in the drone permits available on the internet72. This will allow the public to know where the drones will be, how they are being used, for what purpose the drones are being used. The F.A.A. must also inform the public when security breaches occur for specific drones, and must provide all of the details of the breach73. The Act goes on to introduce a warrant requirement for any data that possibly could be used for evidence in any judicial proceeding74. This includes both criminal and civil proceedings75. The Act states that a person or entity cannot use a drone, or even request information collected by another entity using drones, for protective activities, or for law enforcement or intelligence purposes, except pursuant to a warrant76. The only exception to the warrant requirement is the traditional exigent circumstances exception, including a high risk of a terrorist attack77. Under the Act, information sharing is not allowed, unless it has been specifically authorized by law78. When the data is being submitted as evidence in court, the warrant requirement must have been met, or the evidence is not admissible79. This is a vast expansion of the traditional limits of the warrant requirement. Traditionally, the requirement that evidence be gathered pursuant to a warrant only limited actions taken by law enforcement and other
71 72

Id. Id at. Sec. 340. 73 Id. 74 Id. at Sec. 341. 75 Id. 76 Id. 77 Id. 78 Id. 79 Id.

11

Cyber law 2013

Jeff VanDyke

government actors80. However, since the warrant requirement here applies to "a person", the warrant requirement also applies to private actors that are using their drones for protective activities. The Act does not define what protective activities are. If protective activities were to be interpreted to include activities such as general surveillance, or home security, there could be excessive limits to the use of drones. For example, if Walmart were to use drones to patrol stores for shop lifters, and if patrolling for shoplifters was interpreted to be a protective activity, then Walmart would fall under the warrant requirement. If then Walmart collects video that shows a man shoplifting, the video evidence would not be admissible in court. This is because the Act states that any evidence must have been collected in accordance with the section81. If Walmart did not have a warrant to fly the drone and collect evidence, then the evidence was not collected in accordance with the section requiring a warrant. Because the evidence was collected without a warrant, even if the police were to obtain a warrant to get the video they could not use the video in court, because the video was initially collected by Walmart without a warrant. This would also apply to any home security company that would try and use drones to protect homes from burglars. Without a warrant to fly the drones around the home, any data collected could not be used as evidence. To obtain a warrant, the person requesting a warrant must establish that there is probable cause. Probable cause is a "reasonable amount of suspicion, supported by circumstances sufficiently strong to justify a prudent and cautious person's belief that certain facts are probably true"82. For general surveillance of homes by home security systems, or for general

80 81

http://criminal.findlaw.com/criminal-rights/search-warrant-requirements.html http://markey.house.gov/sites/markey.house.gov/files/documents/3.19.13_DroneAircraftPrivacyTransparencyAc t2013.pdf

82

Handler, J. G. (1994). Ballentine's Law Dictionary (Legal Assistant ed.). Albany: Delmar. p. 431

12

Cyber law 2013

Jeff VanDyke

surveillance of stores, it is hard to imagine a situation where there would be probable cause to issue a warrant for everyday situations. In the case of home security systems, most people do not have the belief that their home is going to be broken into all the time. People buy security systems to feel protected, and to protect their homes in case they are broken into. Most people do not have a reasonable amount of suspicion that their home will be broken into at a certain time, or would have the circumstances to support their fear, to the point that they would be able to obtain a warrant. Without both the suspicion, and without the circumstances to justify the suspicion, warrants would not be obtained by home security companies. The result of this is that prosecutors would not be able to use video surveillance obtained by drones to prosecute crimes against homes that were protected with drones. This would make drones less valuable as a means of home protection. The Act states that it is unlawful for a person or entity to use a drone in any way that deviates from the data collection statement submitted by the drone operator83. The Federal Trade Commission is granted power to enforce the Act, and any violation would be treated as an unfair or deceptive act or practice84. The Act also grants States the right to sue when there has been a violation, or the Act also creates a private right of action where an individual that has been harmed by a violation of the Act can sue as well85. Either the State, or the individual, can sue for an injunction, can sue for monetary damages or $1,000 (whichever is greater), or both86. If the violation Act is found to be intentional, then the court hearing the action is permitted to issue treble damages87. Prevailing plaintiffs are awarded attorney's fees as well as court costs88.

83

http://markey.house.gov/sites/markey.house.gov/files/documents/3.19.13_DroneAircraftPrivacyTransparencyAc t2013.pdf 84 Id. at Sec. 4. 85 Id. 86 Id. 87 Id.

13

Cyber law 2013

Jeff VanDyke

The Act does not include any exceptions to penalties for violating the Act. So if an individual finds out that she has had data collected about her in a way that violates the data collection statement, she has a right of action, regardless of the reason for the violation. This can lead to unexpected consequences for drone operators. For instance, inadvertent observers of crimes could find themselves being sued if they decide to use their drones to further investigate the crime. In the case of drones being used for home security, if the operator of the drone witnesses a kidnapping, and decides to use the drone to follow the criminal and the victim, it is likely that the drone operator will violate the Act. Since the drone only patrols the home, the geographical area specified in the data collection plan will likely be confined to the premises of the home. If the drone were then to leave the property where the home is located, the drone will then have crossed outside of the defined geographical area. The violation of the Act then gives the criminal a private right of action against the drone operator, the home security company. The drone operator knew, or should have known about the geographical limitations of her use of the drone, which would make the violation intentional. The criminal would then be able to get treble damages, and if the criminal prevailed, would also get attorney's fees and court costs. Conclusion Drone technology has been developed by the military since the Vietnam War. As the technology continues to be developed, industries are looking at the possibility of using drones for commercial purposes. Privacy rights could be eroded by the implementation of widespread use of drones in America. Case law governing Fourth Amendment rights against unreasonable searches does little to provide protection of privacy rights, and as technology becomes cheaper and more available, could offer no protection at all. The Drone Aircraft Privacy and Transparency Act of 2013 is a good start at facing the need to implement legislation that will
88

Id.

14

Cyber law 2013

Jeff VanDyke

govern and direct the use of drones in American airspace while protecting privacy rights. The Act forces drone operators to be very transparent with how the drones are being used, as well as forcing the drone operators to stay within the use that has been specified in the operating permits. The civil penalties make it likely that it will not be economically prudent for drone operators to violate their permits, especially since prevailing plaintiffs are awarded attorney's fees. This motivates more individuals that have had information gathered about them in violation of the Act to get relief, even when those individuals have not suffered an economic harm. What this does is motivates individuals to fight to have their privacy rights enforced, since they will be compensated if they prevail. However, the Act needs to be rewritten. There are several large problems with how the Act is currently set up. The first is that the Act imposes a warrant requirement on private actors that use the drones for protective services. This severely limits the use of drones in industries, such as home security. An individual wishing to use a drone to observe their own home should not be required to have a warrant to be able to operate that drone and use the information as evidence in court. The main goal of the Act is to ensure privacy, and when an individual is employing drones to protect their own home, that goal is not being furthered by limiting the use of drones because the individual's privacy is not being threatened. The Act also needs to have exceptions to when a drone may be able to operate outside the data collection statement. In situations, such as lifesaving operations, or observing and reporting a crime, the operator of a drone should not have to worry about whether or not she can help or if she will possibly face a civil penalty because she has taken her drone outside the geographic area specified in the data collection statement. One possible exception could be a Good Samaritan exception, where, when the use of the drone outside the data collection statement would help

15

Cyber law 2013

Jeff VanDyke

stop a crime, or prevent some type of harm the drone operator would be forced to destroy any data gathered while violating the data collection statement, but would not face civil penalties.

16