.png)
According to Gizmodo, schools districts across the U.S. are purchasing and using Mobile Device Forensic Tools (MDFTs). If asking yourself, “WTF is a Mobile Device Forensic Tool?” – you are not alone. Until seeing Gizmodo’s article referenced on TechSpot and Schneier on Security, I was unfamiliar with the official term.
Commonly used by law enforcement agencies, the Department of Defense, and private investigators with capable means, these devices can retrieve photos, data, text messages, call logs and any other information stored on mobile phones. Despite passcodes, there is ample technology available, both legitimately and on the black-market, to break through the initial encryption access barrier – after which, the stored information is often unencrypted and easily downloadable to a basic USB drive.
Indeed, Gizmodo makes the following claim in its article:
Gizmodo analyzed a random sample of 5,000 public school or school district websites across the United States and found that eight district websites mention Cellebrite or another MDFT technology. Because our sample is a relatively small portion of the total number of high schools in the United States—and the ones that stood out did so because they published the purchases as line items in public budget reports—many other school districts may have access to this technology.
The Los Angeles Unified School District, the second-largest school district in the country with over 630,000 students enrolled in over 1,000 institutions in the 2018-2019 school year, has a Cellebrite device it says is used by a team that investigates complaints of employee misconduct against students. Its listed description for the job of Digital Forensics Investigator states, those with that role assist with “student safety issues, fraud, collusion, and/or conflicts of interest,” specifically mentioning expertise with Cellebrite as a qualification.
As a parent, I can admire certain motivations for this move by the participating school districts. However, the attorney-side of my brain is very much alarmed.
Lazy lawyers may cite the United States Supreme Court’s 1985 case, New Jersey v. T.L.O. for the proposition that schools enjoy a liberal “reasonableness” in conducting warrantless searches of student property without Fourth Amendment violations. But look at the date of that case: 1985. What exists now that did not exist in 1985? Smartphones. While New Jersey v. T.L.O. discussed a student’s privacy expectation as to a purse, it does not define scope of searches and purses may not be as private as a Smartphone.
Recently, the Supreme Court and its lower courts focused more on the specific issue of phones. In 2011, the Eastern District of Texas in Mendoza v. Klein Idepend. School District, Civil Action No. H-09-3895, evaluated several issues regarding the confiscation of student phones. Without addressing matters of qualified immunity, the District Court found that a teacher admittedly exceeded the necessary scope of a search of a student phone. Following the confiscation of the phone, all the teacher needed to do to determine if school policy was violated was check if texts were sent during school hours. This task did not require reading any actual messages. However, the teacher read messages and looked at pictures, leaving the court to find the search likely unreasonable (a question ultimately left for a jury).
In 2014 in Riley v. California, 573 U.S. 373, the Supreme Court unanimously held that “police officers generally could not, without a warrant, search digital information on the cell phones seized from the defendants as incident to the defendants' arrests.” Although Riley did not mention a school district’s reasonableness standard, the USSC made an extremely important distinction between the purse in New Jersey v. T.L.O. and a 2014 smartphone:
Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse…Cell phones differ in both a quantitative and a qualitative sense from other objects that might be kept on an arrestee’s person. The term “cell phone” is itself misleading shorthand; many of these devices are in fact minicomputers that also happen to have the capacity to be used as telephones. They could just as easily be called cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.
One of the most notable distinguishing features of modern cell phones is their immense storage capacity. … Most people cannot lug around every piece of mail they have received for the past several months, every picture they have taken, or every book or article they have read—nor would they have any reason to attempt to do so…[T]he possible intrusion on privacy is not physically limited in the same way when it comes to cell phones[.] (Id. at 393-395).
Riley and Mendoza should therefore warn schools using MDFTs to gather information on students to carefully consider the utility of such tools, especially if receiving and/or relying upon federal funding.