Evan Schuman's StorefrontBacktalk

Attorney Mark D. Rasch is the former head of the U.S. Justice Department’s computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

When we told you recently about the Australian shopping mall that tracked customer movement through mobile phone signals, it presented a very compelling CRM opportunity. It would also almost certainly be illegal in the U.S. (What? Everything has to be perfect with you?)

Here, it is illegal to intercept the contents of a cell phone call or to force a cell phone provider to pony up information about a user without—at a minimum—a court order based upon a certification by a law enforcement or other official that the information is relevant to an ongoing criminal (or sometimes intelligence) case. The federal pen register law makes it a crime to “install or use a pen register or trap and trace device” without such a court order, unless you are a “provider of electronic or wire communication service” and your use of the pen register is for certain limited purposes. There is little doubt that neither a mobile nor a mall operator would be considered a “provider of electronic communication services.”

But what exactly is a pen register? Here is where it gets a bit funky. Under U.S. law, a “pen register” is “a device or process which records or decodes dialing, routing, addressing or signaling information.” A “trap and trace device,” for which a court order is also required, means a “device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing and signaling information reasonably likely to identify the source of a wire or electronic communication.”

The key here is the definition of “signaling information,” a provision added after Sept. 11, 2001, in statutory amendments under the USA PATRIOT Act. Several courts have concluded that the term “signaling information” includes things like signal strength data used to determine the location of an individual. It appears that the Australian trial, to the extent that it is recording “signaling” information from a cell phone, would be illegal under U.S. law. It’s also pretty creepy.

If a mall operator wanted to know what consumers do when they enter the mall (“Hey, Mom. I want to go to the eatery, then see Santa and then go to the Apple store!”), that operator could follow them around as they browsed. Operators could also use sophisticated pattern recognition software attached to the ubiquitous digital video cameras to track individuals.

The new “cell phone tracking” technology turns the phone in your pocket, one that you are paying for, into a GPS tracking device for the mall. Your cell phone is really just a radio, constantly transmitting and receiving. Although the company’s Web site does not disclose how it works, it is likely that the device is similar to a cell phone tower itself, transmitting a signal to cell phones within range and receiving back a signal from the cell phone.

Unlike a “real” cell provider, the ping it sends is blank.