Mobile Tracking Would Be Great, If It Weren't Illegal. (What, Everything Has To Be Perfect With You?)

Attorney Mark D. Rasch is the former head of the U.S. Justice Department's computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

When we told you recently about the Australian shopping mall that tracked customer movement through mobile phone signals, it presented a very compelling CRM opportunity. It would also almost certainly be illegal in the U.S. (What? Everything has to be perfect with you?)

Here, it is illegal to intercept the contents of a cell phone call or to force a cell phone provider to pony up information about a user without—at a minimum—a court order based upon a certification by a law enforcement or other official that the information is relevant to an ongoing criminal (or sometimes intelligence) case. The federal pen register law makes it a crime to "install or use a pen register or trap and trace device" without such a court order, unless you are a "provider of electronic or wire communication service" and your use of the pen register is for certain limited purposes. There is little doubt that neither a mobile nor a mall operator would be considered a "provider of electronic communication services."

But what exactly is a pen register? Here is where it gets a bit funky. Under U.S. law, a "pen register" is "a device or process which records or decodes dialing, routing, addressing or signaling information." A "trap and trace device," for which a court order is also required, means a "device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing and signaling information reasonably likely to identify the source of a wire or electronic communication."

The key here is the definition of "signaling information," a provision added after Sept. 11, 2001, in statutory amendments under the USA PATRIOT Act. Several courts have concluded that the term "signaling information" includes things like signal strength data used to determine the location of an individual. It appears that the Australian trial, to the extent that it is recording "signaling" information from a cell phone, would be illegal under U.S. law. It's also pretty creepy.

If a mall operator wanted to know what consumers do when they enter the mall ("Hey, Mom. I want to go to the eatery, then see Santa and then go to the Apple store!"), that operator could follow them around as they browsed. Operators could also use sophisticated pattern recognition software attached to the ubiquitous digital video cameras to track individuals.

The new "cell phone tracking" technology turns the phone in your pocket, one that you are paying for, into a GPS tracking device for the mall. Your cell phone is really just a radio, constantly transmitting and receiving. Although the company's Web site does not disclose how it works, it is likely that the device is similar to a cell phone tower itself, transmitting a signal to cell phones within range and receiving back a signal from the cell phone.

Unlike a "real" cell provider, the ping it sends is blank.Unlike a "real" cell provider, the ping it sends is blank: It neither sends nor receives any actual data (it doesn't capture cell phone calls, nor does it provide a cell phone service). Essentially, all it knows is that there is a cell phone nearby with a particular identification number and a certain signal strength to its transmitter. Add a couple more transmitters, and voila! Through the magic of triangulation, you can now know the exact position of that cell phone. But you won't know the name of the owner—well, at least not yet.

The U.S. Supreme Court will be deciding a case that was argued last week considering whether Americans have a "reasonable expectation of privacy" in their locations when they are not inside their homes. In that case, the government, without a warrant, installed and monitored a GPS transmitter on a suspect's car.

Although this mall technology might not identify specific individuals, it raises a bunch of privacy red flags. First, the instant the consumer identifies himself or herself anywhere in the mall (say, by using a credit or debit card to buy something), it is a trivial task to cross reference the cell phone data with the payment data and realize that the person hanging around outside the Victoria's Secret dressing room was your 70-year-old neighbor.

Despite the fact that the mall security cameras are capturing some of this data, the ability of the proposed technology to "slice and dice" the data makes it creepier still. If you walked into a mall and there was a sign that said, "Hey, we are going to use your cell phone to collect information about where you are going in this mall, who you are hanging out with and where you are going next. Thank you and have a nice day," I am sure you would be creeped out. As a retailer with locations in a mall, you have two choices. Don't ask; don't tell: Don't ask the cell phone where it is (e.g., don't collect the data) or don't tell the customer that you are doing it. Personally, I vote for the former.

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.