Utah Law Would Strike a Balance Between Public Safety and Digital Privacy

This op-ed was originally published in the Salt Lake Tribune on March 13, 2023.

Utah is set to become the first state in the nation to regulate law enforcement’s use of geofence searches — a “reverse search” technique that allows law enforcement to identify criminal suspects by requesting caches of anonymized data from technology companies.

In February, HB57 passed the state House and Senate and is now heading to the desk of Gov. Spencer Cox, where it is expected to be signed into law. This legislation provides a good model for how to preserve digital privacy while also maintaining a commitment to public safety. Other states should follow Utah’s lead and pass similar legislation.

Because geofence searches collect data from all users in a virtual geographic range, they present serious concerns about privacy and civil liberties. Yet, it remains unclear how judges will interpret constitutional questions involving geofence searches as rulings from the bench have been mixed to this point.

One thing that is not in dispute is the explosion of geofence searches. In a recent ruling involving the use of geofence warrants, a judge in Virginia noted the rapid increase in the use of this investigative technique nationwide. From 2017 to 2018 Google saw a 1,500% increase in these requests. Then, between 2018 and 2019, the number of requests rose by 500%.

Given the growing number of these requests and the slow pace of judicial reform, legislatures need to act now to place guardrails on the use of geofence searches. While some states have already introduced legislation on this issue, none have enacted any legislation into law and the few states that are trying to address the issue are not doing so in a way that is most effective.

New York has introduced legislation barring the practice, as have California and Missouri. But none of these states are considering legislation that requires law enforcement to obtain a warrant before issuing a reverse search request to tech companies. Meaning, none of these other proposals strike the necessary balance between public safety and privacy, instead, they seek a full ban on the practice.

While a desire for a blanket ban is understandable, Utah’s legislation offers a more effective solution to privacy concerns by codifying protocols for the use of geofence searches. In so doing, Utah’s approach properly balances the issues of public safety and privacy. Law enforcement is not barred from obtaining information relevant to criminal investigations but reasonable guardrails are put in place to ensure government agents do not abuse the geofence search process.

The Utah law achieves this balance in several ways. First, it codifies warrant requirements, preventing law enforcement officers from submitting requests for geofence data without a judge signing a warrant application. Second, it mandates that warrant applications include a notification to judges regarding the nature of a geofence search by way of a map or written description showing the size of the virtual geofence. Third, it mandates that law enforcement report on their use of geofence warrants by specifying their results.

Additionally, all warrant applications must include a notice detailing how the findings of the warrant may include the collection of digital information of both the alleged “criminal perpetrators and individuals not involved in the commission of a crime.” These regulations ensure judges are given all the information necessary to effectively evaluate the merits of a warrant request.

The bill also provides an additional layer of protection by requiring law enforcement to submit a report to the State Commission on Criminal and Juvenile Justice. These reports must include the number of geofence warrants requested, the number of warrant applications approved by a judge, the number of investigations using information obtained through geofence warrants, and the number of electronic devices for which anonymized electronic data was obtained through these warrants.

After obtaining these reports, the Commission is required to compile a publicly available report. Law enforcement agencies that fail to submit required data are barred from receiving grants from the Commission. All of these additional requirements ensure the legislature can properly monitor the use of these warrants and identify any potential areas of concern that can be addressed by future reforms.

States should look to Utah as a model for reasonable reform on the issue of reverse searches. The sheer volume of data implicated in geofence searches compels state legislators to craft policies that prevent widespread abuse of consumer data. However, given the existence of vast consumer databases, law enforcement officers should be allowed to seek valid warrants to investigate criminal activity.

The Utah Legislature was able to craft consensus legislation that furthers privacy and ensures the excesses of government action are regulated and monitored. This legislation does not solve all problems related to digital privacy and policing in the 21st century, but it is a good start. Other states should follow their lead by passing similar legislation.