Prior to the digital age, surveillance generally meant a government agent or private investigator engaged in a stakeout or observation detail that involved physical work, expense, and time. The digital age changed surveillance fundamentally. Today, we not only generate mountains of data for others, we also effectively surveil ourselves through digitally-connected, multifunctional smart devices, collectively described as the “Internet of Things.”

Cybersurveillance accessed by the government, even when started as self-surveillance, raises complex and uncertain legal issues, especially when related to the Constitution. In United States v. Kyllo, the Supreme Court was reticent to allow government agents to use technology that went through the walls of homes, spying on people within without a warrant under the Fourth Amendment. Current technologies allow the police to do that and more, especially when all of the data is pieced together and analyzed in a personal mosaic. The implications are profound. Is there anything left of the public/private distinction? Does the invisibility of data transfer undermine the separation of powers and the ability to effectively check and balance the Executive branch’s spying operations? This paper examines the constitutional implications of the Internet of Things, arguing that unless models of consent and privacy are changed, outdated legal rules will fail to protect the individual from the state in fundamental ways.

The latest spying craze is the “stalking app.” Once installed on someone’s cell phone, the stalking app can provide continuous access to the phone owner’s calls, texts, snapchats, photos, calendar updates, and movements. Stalking apps destroy the privacy and confidentiality of cell phone activities. Domestic abusers and stalkers frequently turn to stalking apps because they are undetectable even to sophisticated phone owners.

Business is booming for stalking app providers, even though their entire enterprise is arguably illegal. Federal and state wiretapping laws ban the manufacture, sale, or advertisement of devices knowing their design makes them primarily useful for the surreptitious interception of electronic communications. But those laws are rarely, if ever, enforced. Existing law may be too restrictive to make a real difference.

A legal agenda is essential to combating the growth of stalking software. We need to update criminal and civil penalties facing providers. Record-keeping requirements could help decrease the demand for spyware. Private rights of action, if recognized, could help secure redress and deterrence. To increase the likelihood that the law will be enforced, states and localities need more training and digital forensic expertise. The private sector could reinforce these efforts by offering devices that can resist the installation of spyware.