Minnesota Judges Spent Only Minutes Approving Warrants Sweeping Up Thousands Of Cellphone Users

from the redefining-bulwark dept

Tony Webster, writing for MPR News, has obtained court documents showing Minneapolis, Minnesota law enforcement agencies are deploying "reverse warrants" in hopes of tying suspects to crime scenes. A normal warrant targets a known object. Reverse warrants are loaded with unknowns -- an attempt to wrangle cell site location info into something that might lead police to a suspect. That's what these agencies are trying to do, but the approved warrants guarantee a sizable number of non-criminals will be swept up in the data haul.

Knowing the Silicon Valley giant held a trove of consumer mobile phone location data, investigators got a Hennepin County judge to sign a "reverse location" search warrant ordering Google to identify the locations of cellphones that had been near the crime scene in Eden Prairie, and near two food markets the victims owned in Minneapolis and St. Paul.

The scope of the warrant was so expansive in time and geography that it had the potential to gather data on tens of thousands of Minnesotans.

This new brand of warrant was first spotted last spring. Later that year, it was confirmed the feds were also using reverse warrants. These warrants are becoming more common, urged on by a private company pitching investigative methods and tools to law enforcement agencies.

[Brooklyn Park Deputy Police Chief Mark] Bruley said detectives learned about the potential value of the practice and how to write the warrant applications at an August training seminar held by ZetX, an Arizona-based company that teaches police about cellphone investigations, and sells software called TRAX that generates legal documents and maps cellphone data to assist in analysis. The company holds trainings all across the country.

[...]

The week after detectives attended the ZetX training in the Twin Cities, they wrote up their first three reverse location search warrants. By the next month, they had a dozen, each ordering Google to turn over information on devices located in the vicinity of crimes.

The warrants [PDF] demand Google turn over a bunch of data on every phone that happened to wander into a geofenced area around the time a crime was committed.

This warrant is directed to Google LLC, headquartered at 1600 Amphitheatre Parkway, Mountain View, California, and applies to (1) GPS, WiFi, Bluetooth or cellular sourced location history data generated from devices that reported a location within the geographical region bounded by the following latitudinal and longitudinal coordinates, dates, and times ("Initial Search Parameters")...

[...]

For each location point recorded within the Initial Search Parameters, Google shall produce anonymized information specifying the corresponding unique device ID, timestamp, coordinates, display radius, and data source, if available (the "Anonymized List").

As Webster notes, the warrants likely don't give judges any idea how many people will be swept up in these data requests. The warrants contain GPS coordinates but no map of the area covered. It's unlikely a judge can visualize the area covered just by looking at four coordinates. Judges may be able to enter those points into Google Maps to get some idea how much area is covered, but it doesn't appear any of the judges approached did anything more than briefly browse the warrants before signing them.

Here's how long it took to approve one requested by the Brooklyn Park PD:

No map was provided in the application to illustrate the area or accuracy level to the judge. This warrant was also issued within about 10 minutes of the detective requesting it.

Things moved even faster for Edina investigators:

About four minutes after the detective signed the application — which included no map of the targeted area — the judge approved it.

Webster has provided the maps the police wouldn't, which illustrate exactly how big an area is being covered by these reverse warrants. (Click through for a larger version.)

Given the scope of the area covered and the imprecise nature of location data, each warrant has the potential to generate a ton of false positives -- people who happen to live, work, or travel through these busy areas. If a map had been provided, there's a good chance judges would have taken a little longer considering these requests.

Or not.

Of the 22 reverse location search warrants issued in Hennepin County, only three times did the warrant applications include map demonstrating the geographic area being targeted by the warrant. And yet, the time difference between an officer signing a warrant request, and a judge approving it, was sometimes just a few minutes.

There's not a lot of good news from the law enforcement perspective either. Most of the reverse warrants failed to generate possible suspects. They also failed to generate false positives either, so that's a (very limited) plus. But I don't think a lack of success will deter investigators from seeking these warrants. Reverse warrants allow officers to perform a virtual canvassing of the neighborhood for possible suspects without expending much in the way of time or manpower.

Google appears to be pushing back when requests are excessive. This is all well and good, but Google's a one-stop shop for law enforcement thanks to its expansive data harvesting over the years. The initial pushback should be coming from judges, not the private sector. When it's up to a data-hungry megacorp to provide the first layer of protection for cellphone users' privacy, the judicial system is failing to do its job.

Filed Under: general warrants, hennepin county, location info, minneapolis, police, reverse warrants
Companies: google

How Bike-Sharing Services And Electric Vehicles Are Sending Personal Data To The Chinese Government

from the why-we-can't-have-nice-things dept

A year ago, Techdirt wrote about the interesting economics of bike-sharing services in China. As the post noted, competition is fierce, and the profit margins slim. The real money may be coming from gathering information about where people riding these bikes go, and what they may be doing, and selling it to companies and government departments. As we warned, this was something that customers in the West might like to bear in mind as these Chinese bike-sharing startups expand abroad. And now, the privacy expert Alexander Hanff has come across exactly this problem with the Berlin service of the world's largest bike-sharing operator, Mobike:

data [from the associated Mobike smartphone app] is sent back to Mobike's servers in China, it is shared with multiple third parties (the privacy policy limits this sharing in no way whatsoever) and they are using what is effectively a social credit system to decrease your "score" if you prop the bike against a lamp post to go and buy a loaf of bread.

Detailed location data of this kind is far from innocuous. It can be mined to provide a disconcertingly complete picture of your habits and life:

through the collection and analysis of this data the Chinese Government now likely have access to your name, address (yes it will track your address based on the location data it collects), where you work, what devices you use, who your friends are (yes it will track the places you regularly stop and if they are residential it is likely they will be friends and family). They also buy data from other sources to find out more information by combining this data with the data they collect directly. They know what your routines are such as when you are likely to be out of the house either at work, shopping or engaging in social activities; and for how long.

As Hanff points out, most of this is likely to be illegal under the EU's GDPR. But Mobike's services are available around the world, including in the US. Although Mobike's practices can be challenged in the EU, elsewhere there may be little that can be done.

And if you think the surveillance made possible by bike sharing is bad, wait till you see what can be done with larger vehicles. As many people have noted, today's complex devices no longer have computers built in: they are, essentially, computers with specialized capabilities. For example, electric cars are computers with an engine and wheels. That means they are constantly producing large quantities of highly-detailed data about every aspect of the vehicle's activity. As such, the data from electric cars is a powerful tool for surveillance even deeper than that offered by bike sharing. According to a recent article from Associated Press, it is an opportunity that the authorities have been quick to seize in China:

More than 200 manufacturers, including Tesla, Volkswagen, BMW, Daimler, Ford, General Motors, Nissan, Mitsubishi and U.S.-listed electric vehicle start-up NIO, transmit position information and dozens of other data points to [Chinese] government-backed monitoring centers, The Associated Press has found. Generally, it happens without car owners' knowledge.

What both these stories reveal is how the addition of digital capabilities to everyday objects -- either indirectly through smartphone apps, as with Mobike, or directly in the case of computerized electric vehicles -- brings with it the risk of pervasive monitoring by companies and the authorities. It's part of a much larger problem of how to enjoy the benefits of amazing technology without paying an unacceptably high price in terms of sacrificing privacy.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bike sharing, china, electric vehicles, gdpr, location, location info, privacy

Feds Also Using 'Reverse Warrants' To Gather Location/Identifying Info On Thousands Of Non-Suspects

from the just-google-it dept

Because nearly everyone carries a tracking device on their person these days, it's become a whole lot easier for the government to find out where everybody's been. It's TinEye but for people, and it appears to be a new go-to tool for law enforcement. What used to be officers canvassing the area where a crime took place is now a warrant sent to Google to obtain location data and identifying info for all people and devices in the area.

These so-called "reverse warrants" first started coming to light earlier this year. The Raleigh Police Department (NC) was serving warrants to Google in hopes of figuring out who to suspect of committing crimes, rather than having a suspect in mind and working forward from there. The warrants were of the "general" variety, guaranteed to give the RPD location/identifying info of hundreds of non-suspects who just happened to be in the area. There's some evidence Google has pushed back against these warrants, but it hasn't been enough to deter law enforcement from continuing to use Google as one-stop shopping to bulk location/identifying info.

This practice isn't limited to the local boys. Thomas Brewster of Forbes has obtained a warrant [PDF] showing the FBI is doing the same thing.

The most recent order on Google, unearthed by Forbes earlier this week, came from the FBI in Henrico, Virginia. They went to Google after four separate robberies in which unidentified, armed individuals entered and stole from the same Dollar Tree store between March and September this year. The manager of the Dollar Tree was also robbed at gunpoint while dropping off money at a Wells Fargo night-deposit box located just down the road from the store.

The warrant asks for location histories held by Google for anyone within three separate areas—including regions around the Dollar Tree store and the Wells Fargo address—during the times and days the five robberies took place. The FBI also wanted identifying information of Google account holders in those areas, two of which had a 375-meter radius. The other had a 300-meter radius.

Since Dollar Tree stores are never found thousands of feet away from other businesses and residences, the information demanded of Google would include hundreds or thousands of innocent people who live or work near the targeted store.

This isn't the way warrants work. Or, at least, this isn't how they're supposed to work. Unfortunately, the FBI's stated probable cause for demanding this info isn't attached to the document Forbes obtained, so it's unclear how the FBI talked a judge into signing off on this. What the returned warrant does show is no records were returned, suggesting Google is pushing back against broad requests for data that appear to be unsupported by probable cause.

While this may be the digital equivalent of canvassing nearby businesses and residences to search for suspects, these orders make compliance compulsory by eliminating the citizenry. It appears the government believes the combination of warrants and third-party data makes gathering info on hundreds or thousands of non-suspects constitutional. The FBI's warrant also came with an indefinite gag order, so no one included in the search radius had any idea federal law enforcement wanted to know who they were or where they'd been.

This search tactic will continue to be deployed until a court puts an end to it. Without more data, it's hard to say how often magistrates approve or reject these reverse warrants. All we know is some warrants have been approved. And in some cases, Google has refused to provide the data. I'm sure law enforcement knows these demands for data aren't completely constitutional, which may be why we haven't seen any agency bring Google to court for refusing to comply. Additional judicial scrutiny isn't going to do these warrants any favors.

Filed Under: 4th amendment, doj, fbi, location info, reverse warrants, warrants
Companies: google

FBI Tried To Get Google To Turn Over Identifying Info On Hundreds Of Phone Owners

from the not-how-the-4th-Amendment-works dept

The US government isn't supposed to seek general warrants. And US judges aren't supposed to approve them. The Fourth Amendment requires a showing of probable cause to justify the intrusion by the government into citizens' lives and property. None of that appears to have happened in this case, brought to us by Thomas Fox-Brewster at Forbes.

Back in March, as it investigated a spate of armed robberies across Portland, Maine, the FBI made an astonishing, unprecedented request of Google. The feds wanted the tech giant to find all users of its services who’d been within the vicinity of at least two of nine of those robberies. They limited the search to within 30-minute timeframes around when the crimes were committed. But the request covered a total space of 45 hectares and could’ve included anyone with an Android or iPhone using Google’s tools, not just the suspect.

This wasn't just a demand for device IDs. The FBI -- as detailed in the warrant request [PDF] -- wanted everything Google had on hand.

In addition, for any Google accounts linked to the accounts or identifiers listed in Attachment A by HTTP cookies, recovery email address, or telephone number, the Provider is required to disclose all records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number).

This is the sort of rummaging the Constitution is supposed to prevent. It's understandable the FBI needed some assistance tracking down robbery suspects, but this grab for a wealth of information about 45 hectares of people milling about minding their own business, isn't. And this sort of thing isn't limited to the FBI. As was covered here earlier this year, the Raleigh PD did the same thing at least four times during criminal investigations in 2017.

In this case, hundreds of people would have been swept up in the dragnet. Certainly, some post-acquisition data sifting would have occurred to narrow it down to people/devices near the location of robberies when they occurred. But whatever happens after info is obtained cannot be used to justify the original acquisition. This warrant never should have been signed.

If there's any good news coming out of this, it's that Google either didn't hand over the info requested or didn't have the info requested on hand.

Google was expected to return the information on April 19, but didn’t. The FBI filed a motion to extend the time it had to get the data, which a judge granted. But Google never handed it over, despite another three FBI motions to extend. Though the prosecutor, assistant U.S. attorney Michael Conley, said a fifth motion would be filed if the data didn’t arrive, the government gave up the ghost earlier this month.

A final returned warrant, dated August 6, simply stated: “Google did not provide information responsive to the warrant.”

The reason for this is unknown. Google provided no comment to Forbes and Brewster-Smith points out the company never filed an objection to warrant itself. It's hard to believe Google didn't have any of this info on hand -- especially considering Google has collected location data even when device users have turned location services off. If nothing else, it should have had some data points on hand. Perhaps there was a lot of discussion behind the scenes between lawyers from both sides that never made it to court but did result in the FBI's please-don't-call-it-"general" warrant being denied.

It also may be the FBI didn't press the issue because it didn't have much confidence in securing a favorable ruling from a judge higher-placed than the magistrate that signed the warrant request. The last thing the FBI wants is precedent set forbidding this sort of collection effort.

Filed Under: doj, fbi, general warrants 4th amendment, location info, maine, portland, robberies, warrants
Companies: google

Google's Location Info Failure Might Interest The FTC

from the do-better dept

Earlier this week, the Associated Press did a story revealing that even for Google users (on both Android and iPhone) who turned off location tracking Google was still tracking their location in some cases.

Google says that will prevent the company from remembering where you’ve been. Google’s support page on the subject states: “You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

That isn’t true. Even with Location History paused, some Google apps automatically store time-stamped location data without asking. (It’s possible, although laborious, to delete it .)

For example, Google stores a snapshot of where you are when you merely open its Maps app. Automatic daily weather updates on Android phones pinpoint roughly where you are. And some searches that have nothing to do with location, like “chocolate chip cookies,” or “kids science kits,” pinpoint your precise latitude and longitude — accurate to the square foot — and save it to your Google account.

If you squint, you can kind of see why this might have happened. Apps like Maps and weather more or less need your location info to work well (though, the search part is a bit more baffling). But, even so, this seems like a huge blunder by Google, a company that should absolutely know better. The latest, of course, is that Google has quietly moved to update the language that users see to "clarify" that some location data may still be recorded:

But its help page for the Location History setting now states: “This setting does not affect other location services on your device.” It also acknowledges that “some location data may be saved as part of your activity on other services, like Search and Maps.”

Previously, the page stated: “With Location History off, the places you go are no longer stored.”

It's entirely possible, if not likely, that the location history feature is completely disconnected from the location specific data within these other apps. But, still, the average consumer is not going to realize that. Indeed, the tech savvy consumer is mostly unlikely to understand that. And Google's new "clarification" isn't really going to do a very good job actually clarifying this for people either. Google certainly has done a better job than a lot of other companies both in providing transparency about what data it collects on you and giving you controls to see that data, and delete some of it. But this was still a boneheaded move, and it's simply ridiculous that someone at the company didn't spot this issue and do something about it sooner.

As I've been pointing out for a while, a big part of why so many people are concerned about privacy on digital services is because those services have done a piss poor job of both informing users what's happening, and giving them more control over the usage of their data. This kind of situation is even worse, in that under the guise of giving users control (a good thing), Google appears to have muddied the waters over what information it was actually collecting.

I also wonder if this will make the FTC's ears perk up. There is still an FTC consent decree that binds the company with regards to certain privacy practices, and that includes that the company "shall not misrepresent in any manner, expressly or by implication... the extent to which consumers may exercise control over the collection, use, or disclosure of covered information." And "covered information" includes "physical location."

Would these practices count as misrepresenting the extent to which consumers could stop Google from collecting location info? It certainly seems like a case could be made that it does. There are many areas where it feels like people attack the big internet companies just because they're big and easy targets. Sometimes those attacks are made without understanding the underlying issues. But sometimes, I'm amazed at how these companies fail to take a thorough look at their own practices. And this is one of those cases.

Filed Under: ftc, google maps, location, location info, privacy, transparency
Companies: google

Bad Bill Would Create A Nationwide Exception To Subpoena And Warrant Requirements For Cellphone Location Data

from the STOP-TRYING-TO-HELP dept

It's a law named after a crime victim, so you already know it's going to be questionable. Federal lawmakers are floating a bill aimed at undermining some of the Fourth Amendment just handed back to us by the Supreme Court. At stake is cell site location info, although in a much more limited amount and in much more limited form. The EFF's Dave Ruiz has more details.

The Kelsey Smith Act (H.R. 5983) tries to correct a tragedy that occurred a decade ago by expanding government surveillance authorities. It is a mis-correction.

The bill would force cell phone companies to disclose the location of a person’s device at the request of police who believe that person is in distress. On its face, that’s not unreasonable. But if the police make a mistake—or abuse their power—the bill offers almost no legal recourse for someone whose location privacy was wrongfully invaded.

This law is named after Kelsey Smith, who was murdered more than a decade ago. Police approached Verizon asking for her cellphone's current location, only to be told they needed to get a subpoena. By the time police had obtained that, Smith was already dead -- killed the same day she was kidnapped. As Ruiz points out, Kansas lawmakers immediately carved out an emergency exception for cell location ping orders, stripping away subpoena requirements. This bill would extend that to all 50 states.

The problem is the bill's wording, which would eliminate privacy protections granted to Americans under the nebulous heading of "emergency." The bill's language contains an expansive definition for the new subpoena/warrant exception, which would definitely cover no one idea of an emergency.

The Kelsey Smith Act allows law enforcement agents to access the location of any cell phone that has dialed 9-1-1 for emergency assistance in the last 48 hours. Almost by definition, that’s not an emergency. Emergencies are of-the-moment crises, requiring immediate responses. If you call 9-1-1 today to request emergency assistance, law enforcement shouldn’t be able to get your location information 48 hours later without showing that the call relates to a current emergency.

At this point, service providers can make judgment calls on demands for location info. A provider can demand a subpoena or warrant first, even if law enforcement claims it's an emergency. These assessments are made on behalf of their customers, protecting their privacy against needless intrusion. If the police need the info, they have the burden of showing cause. This bill would do more than simply reverse the burden of proof. It would do away with it completely, forcing service providers to turn over info any time an officer states it's an emergency.

The problem with granting law enforcement a longer leash in these cases is they've been shown to abuse the permissions they already have. The EFF's post contains statements from the ACLU's Nate Wessler about abuse of emergency exceptions in police departments all over the nation, used in criminal cases involving no real emergencies.

But that's not all. The Justice Department's watchdog has uncovered systemic abuse of the same exceptions by federal officers.

In a 2010 report, the Department of Justice’s Inspector General found systemic misuse of emergency requests for call record information by the FBI. The report found that emergency requests were used in entirely non-life-threatening situations, including three “media leak investigations,” one of which resulted in the collection of telephone records from Washington Post and New York Times reporters.

While nominally limited to phones that have dialed 9-1-1, the exception encourages officers to think outside the Fourth Amendment's box and use the paperless route whenever possible. This isn't speculation. This is what's already happening. At this point, it's still mainly up to service providers to fend off BS demands for location data. If this bill passes, the last barrier will be torn down, turning service providers into unofficial extensions of law enforcement agencies.

Filed Under: 4th amendment, emergencies, exceptions, kelsey smith, kelsey smith act, law enforcement, location info, subpoena, warrants

Post-Carpenter Ruling Says Call Records Aren't Content Or Cell Site Location Info; Thus, No 4th Amendment Protection

from the narrow-ruling-means-narrow-applications dept

Judicial citations and applications of the recent Supreme Court decision in the Carpenter case continue to roll in. The narrow holding by the Supreme Court was that acquisition of cell site location info (CSLI) now requires a warrant, seeing as it can be used to effectively "track" someone over a period of days or months. Historical CSLI -- especially large amounts of it -- is far more revealing than many other records covered by the Third Party Doctrine. An "equilibrium shift" was needed and the court applied it.

The shift is trickling down to lower courts, leading to some examinations of the Carpenter ruling in cases that don't appear to call for it. The Supreme Court of California, ruling [PDF] on a case that originated 15 years ago, takes a brief moment to weigh the Carpenter ruling against the specifics of this appeal. (via FourthAmendment.com)

At stake here -- one of the several challenges raised by the defendant -- are phone records gathered with an SCA court order. Phone records were left undisturbed by the Carpenter ruling, but here's the court's brief examination of the issue.

The prosecution presented telephone records and testimony showing telephone calls among the various participants during relevant times. It obtained the telephone records pursuant to a court order under 18 United States Code section 2703, part of the federal Stored Communications Act. (See Carpenter v. United States (June 22, 2018, No. 16-402) 585 U.S. __. __ [2018 WL 3073916 p. *4].) Defendant moved to suppress the evidence, partly on the ground that obtaining the records without a search warrant violated his rights under the Fourth Amendment to the United States Constitution.

Unsurprisingly, the trial court -- ruling years before the Supreme Court's decision -- found this to be constitutional under the Smith v. Maryland decision, which solidified the Third Party Doctrine framework. The court here notes the records now exempted from the Third Party Doctrine include records obtainable under the Stored Communications Act. Still, it finds no violation -- not because the Carpenter ruling wasn't in place yet, but because call records aren't communications.

The United States Supreme Court has now held that a search warrant is needed to obtain at least some types of information governed by the Stored Communications Act. (Carpenter v. United States, supra, 2018 WL 3073916.) The court stressed that its holding is “narrow,” and that it did “not disturb the application of” cases such as Smith v. Maryland, supra, 442 U.S. 735. (Carpenter, at p. *13.) It is not clear whether Carpenter’s holding would apply here. But we need not decide the question. Any error was harmless beyond a reasonable doubt. The evidence merely showed that some of the alleged conspirators communicated by telephone at certain times; the content of the communications was not revealed. Although relevant, the evidence was unimportant in light of the trial as a whole.

Even if this were being challenged post-Carpenter and even if the originating events happened after the Supreme Court's decision, the outcome would still be the same. The Supreme Court issued no opinion on the privacy implications of phone call metadata and took care to leave the Third Party Doctrine standing, minus the small part it trimmed off for historical CSLI. Content has always required warrants. There's a whole set of wiretap laws and litigation pertaining to it. Dialed numbers haven't been given Constitutional protection in over 50 years. But it is good to know courts are at least seeking to apply the ruling in cases where there's no obvious application, rather than ignoring the implications of the ruling completely.

Filed Under: 4th amendment, call records, carpenter, location info, scli, warrants

Court Compares Car Crash Data To CSLI, Cellphone Contents; Tells Cops Best Bet Is To Always Get A Warrant

from the I'll-show-you-mine-if-you-show-me-your-[warrant] dept

The Supreme Court's ruling in the Carpenter case came as something of a surprise. The nation's courts seemed unwilling to start paring back the Third Party Doctrine, but the expansion of people's digital footprints following the widespread adoption of smartphones proved to be too big to ignore. The ruling was narrow -- finding only that the acquisition of historical cell site location info (CSLI) was a search under the Fourth Amendment -- but it possibly contains broader applications.

The way it stands now, law enforcement needs a warrant to collect CSLI from cell service providers -- the first hole that's been poked in the Third Party Doctrine since its inception almost 40 years ago. If not for the Riley decision -- the one that recognized phones no longer resembled "containers" or "pockets," but rather contained a detailed depiction of a person's entire life -- the Supreme Court may not have arrived at this conclusion. But it was that decision that first conjured up the image of the government happily discovering people were carrying around personal tracking devices loaded with info 24 hours a day. Grabbing large quantities of CSLI -- 127 days in Carpenter's case -- turned cellphones into ad hoc ankle bracelets, allowing the government to reconstruct someone's movements over a period of months using only a subpoena.

The lower courts are now starting to apply the Carpenter ruling as defendants use this decision to challenge evidence against them. In this case reviewed by the Georgia Court of Appeals, the warrantless acquisition didn't involve cell site location info, but rather a vehicle's black box. Here are the facts of the case, from the decision [PDF]:

On December 15, 2014, the vehicle driven by Victor Lamont Mobley collided with a vehicle driven by W. M. W. M. and the passenger in his vehicle, C. F., were killed in the collision. Mobley was charged with reckless driving, two counts of homicide by vehicle in the first degree (alleging that he caused the deaths of W. M. and C. F. through the act of reckless driving), and speeding (alleging that he drove a vehicle at a speed of 97 miles per hour in a 45-mile-per-hour zone). Mobley moved to suppress evidence that was obtained from the airbag control module (“ACM”) in the vehicle he was driving, which showed that the vehicle was traveling at a speed of 97 miles per hour five seconds before airbag deployment.

Inevitable discovery was the call, with the trial court finding the ACM would have been removed and its data accessed following the crash, so the one-day delay between the original access and the search warrant was negligible. The appeals court dives a little deeper into the issue, bringing along Carpenter for the ride, but not until the concurring opinion. It first takes a look at the implications of the Supreme Court's Riley decision on the warrantless access to otherwise "hidden" info.

Mobley [...] contends that we should follow the reasoning employed by a Florida appellate court, which held (in a divided opinion) that a search warrant was required to access ACM data in an impounded vehicle. The Worsham court found that ACMs “document more than what is voluntarily conveyed to the public and the information is inherently different from the tangible ‘mechanical’ parts of a vehicle.” Citing Riley, supra and analogizing the ACM to a cell phone, the Worsham court reasoned that because the recorded data is not exposed to the public, and because the data is difficult to retrieve and interpret, there is a reasonable expectation of privacy in the data.

The court finds the access of ACM data does not approach the level of privacy intrusion warrantless access to cellphone's contents would. What a driver does on a public road is observable by others, even if not to the level of detail an ACM provides.

We find that, under the circumstances in this case, Mobley did not have a reasonable expectation of privacy in the data from his vehicle’s ACM. See generally Bowling, supra. While an outside observer cannot ascertain the information regarding the use and functioning of a vehicle with the same level of precision as that captured by the ACM, there are outward manifestations of the functioning of some of the vehicle’s systems when a vehicle is operated on public roads. For example, a member of the public can observe a vehicle’s approximate speed; observe whether a vehicle’s brakes are being employed by seeing the vehicle slow down or stop or the brake lights come on, by hearing the sounds of sudden braking; and observe whether the driver is wearing a seatbelt. There is no reasonable expectation of privacy in such information because an individual knowingly exposes such information to the public.

[...]

Information regarding the mechanical functioning of the vehicle and its systems is qualitatively different from photographs, financial information, and other such personal data that may be found on a cell phone.

The Carpenter connection would be long-term data collecting by the ACM, which would allow the government to reconstruct a person's movements over a long period of time. But, as far as the court can tell, most -- if not all -- ACMs only record pertinent info at the time the airbag deploys. It is not a tracking device, wittingly or unwittingly.

The court signs off on its opinion by warning law enforcement that the best route is to always obtain a warrant, if possible.

We therefore limit our holding to the particular facts of this case, and note that future treatment of this issue will likewise depend on the specific facts of the cases under consideration. As such, we reiterate the strong preference for searches to be conducted pursuant to a warrant, see Jones v. State, 337 Ga. App. 545, 548 (1) (788 SE2d 132) (2016), and caution law enforcement officers faced with an investigative need to obtain data from a vehicle’s ACM to err on the side of caution by obtaining a search warrant before retrieving that information.

The concurring opinion notes a few things. First, some ACMs may collect more data than others, making these much more analogous to the CSLI obtained in the Carpenter case. That alone should prompt officers to seek a warrant before downloading the data -- especially when vehicles have been towed and held for a crash investigation. This removes any exigency and allows the search to continue on the court's time, rather than whenever officers feel like it.

It also notes getting a warrant first would be the safer choice as the removal of the ACM may very well qualify as a government trespass onto private property. The automobile exception may excuse cursory searches and inventory of a car's contents if it removed from the scene of a stop, but it does not permit the government to obtain data from a vehicle's electronics.

The opinion reiterates the warning handed out by the majority: Get a warrant.

[L]aw enforcement will find it increasingly tricky to navigate the crossroads of ever-advancing technology and personal privacy as they relate to Fourth Amendment prohibitions. And this difficulty is only exacerbated by the fact that the decisions of the Supreme Court of the United States establish that warrantless searches are typically unreasonable where “a search is undertaken by law enforcement officials to discover evidence of criminal wrongdoing.” But as the Supreme Court emphasized once again in Carpenter v. United States, there remains a tried and true means of safely traversing these crossroads when law enforcement’s specific obligations under the Fourth Amendment are in doubt—get a warrant. This default position seems especially wise in light of the “equilibrium-adjustment” the Supreme Court of the United States recently made in Carpenter.

As for any arguments that new warrant requirements will harm law enforcement efficiency, the court waves them away by explaining the Fourth Amendment isn't supposed to make things easy for the government.

And while obtaining a warrant may not always lend itself to expediency, our republic’s Fourth Amendment jurisprudence has “historically recognized that the warrant requirement is ‘an important working part of our machinery of government,’ not merely an inconvenience to be somehow ‘weighed’ against the claims of police efficiency.”

It also notes that if anyone's losing the Tech Arms Race, it's citizens, not law enforcement. They're at the mercy of a judicial system that isn't known for its turn rate on tech-implicating cases.

I am confident the vast majority of our law enforcement officers will err on the side of caution and liberty, and get a warrant in cases like the one before us. The law always seems to be several steps behind technology, and this approach strikes me as the most prudent course of action going forward.

The main takeaway from Carpenter is this: Get. A. Warrant. Why take a chance a court may find whatever third party data you built a case on to be protected under the Fourth Amendment? A warrant -- even if badly/broadly written -- will generally score law enforcement some points in the "good faith" category, insulating obtained evidence from attempts to have it suppressed.

Filed Under: 4th amendment, black boxes, carpenter, csli, location info, warrant

Supreme Court Says Warrants Are Needed For Cell Site Location Info

from the 4th-Amendment-Bonus-Content! dept

The Supreme Court -- in a narrow decision (both in scope and votes) -- has restored a little more of the Fourth Amendment. The long-awaited decision [PDF] in the Carpenter case has been released and the Supreme Court finds, in a 5-4 decision, that cell site location info (CSLI) is technically a third-party record but worthy of the Fourth Amendment's protection.

The defendant challenged the government's warrantless acquisition of 127 days of CSLI, arguing that the constant location records generated (without proactive assistance from phone users) by cell providers raised enough of a privacy issue the Fourth Amendment was implicated. Somewhat surprisingly -- given the long history of expansive readings of the Third Party Doctrine -- the Supreme Court agrees.

[W]hile the third-party doctrine applies to telephone numbers and bank records, it is not clear whether its logic extends to the qualitatively different category of cell-site records. After all, when Smith was decided in 1979, few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person’s movements.

We decline to extend Smith and Miller to cover these novel circumstances. Given the unique nature of cell phone location records, the fact that the information is held by a third party does not by itself overcome the user’s claim to Fourth Amendment protection. Whether the Government employs its own surveillance technology as in Jones or leverages the technology of a wireless carrier, we hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI. The location information obtained from Carpenter’s wireless carriers was the product of a search.

The court notes simply venturing out into the public does not erase all privacy expectations. The pervasive tracking engaged in by phone companies for business reasons should not undo a person's reasonable expectation of privacy. While the government tried to compare it to tracking vehicles with GPS devices, the court notes that cars cannot go everywhere people go. Long-term tracking -- made possible by provider recordkeeping -- provides the government with detailed depictions of cellphone users' lives. And all of this was -- up until this decision -- only a subpoena away.

[H]istorical cell-site records present even greater privacy concerns than the GPS monitoring of a vehicle we considered in Jones. Unlike the bugged container in Knotts or the car in Jones, a cell phone—almost a “feature of human anatomy,” Riley, 573 U. S., at ___ (slip op., at 9)—tracks nearly exactly the movements of its owner. While individuals regularly leave their vehicles, they compulsively carry cell phones with them all the time. A cell phone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, political headquarters, and other potentially revealing locales.

[...]

Accordingly, when the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.

The ubiquity of cellphones has changed the Third Party Doctrine dynamic. The court isn't willing to give the government warrant-free access to the personal lives of millions of Americans.

Critically, because location information is continually logged for all of the 400 million devices in the United States—not just those belonging to persons who might happen to come under investigation— this newfound tracking capacity runs against everyone. Unlike with the GPS device in Jones, police need not even know in advance whether they want to follow a particular individual, or when.

That's the substance of the decision, but the whole thing is worth reading in full. Even the dissents are worth a read, if only to see how many justices would prefer the government treat long-term tracking as no different than bank records people voluntarily create with every transaction. The court will extend the Third Party Doctrine to cover historical CSLI. However, it does not extend that coverage to cover tower dumps, real-time CSLI (ping orders/Stingray use) or any other records otherwise covered by the Third Party doctrine. But this is still a significant Fourth Amendment win -- and law enforcement agencies using CSLI subpoenas to cover Stingray use will now need to craft warrant requests specifying what they're doing, which will make just a little bit tougher to engage in parallel construction.

More than half the page total is given over to the dissent. Justices Kennedy and Alito have written separate dissents that say pretty much the same thing:

1. The records were obtained from a third party so no warrant should ever be needed.

2. This will law enforcement's work more difficult.

Even if the latter is true, Constitutional protections protect the citizens from their government. If they're an obstacle, they're meant to be. The court isn't there to ensure easy government access. It's there to act as a check against any government overreach it observes.

Justice Thomas' dissent is perhaps the most infuriating read. Much like his dissent in other law enforcement-related cases, Thomas sides with the government while claiming he's siding with the Constitution. His main argument here is that the Fourth Amendment says nothing about privacy or reasonable expectations, therefore the court's decision is wrong. It guards people and papers, not stuff obtained from third parties, no matter how invasive these records can potentially be.

Justice Gorsuch's dissent, however, is an entertaining read. It's really not even a dissent. He agrees with the majority's decision but doesn't think it goes far enough. If Gorsuch had his way, he would also return to a more originalist view of the Fourth Amendment -- the property rights theory he pitched during oral arguments. But unlike Thomas, his would eliminate the court-erected Third Party Doctrine and grant privacy to records created by customers/users and held by third parties. These decisions (Smith, Miller, Katz) would instead be replaced with a property-based treatment of records, giving customers/users more ownership rights to third-party records they create, making them part of the "houses and papers" Fourth Amendment interpretation even if the the "papers" are held by others.

I cannot fault the Sixth Circuit for holding that Smith and Miller extinguish any Katz-based Fourth Amendment interest in third party cell-site data. That is the plain effect of their categorical holdings. Nor can I fault the Court today for its implicit but unmistakable conclusion that the rationale of Smith and Miller is wrong; indeed, I agree with that. The Sixth Circuit was powerless to say so, but this Court can and should. At the same time, I do not agree with the Court’s decision today to keep Smith and Miller on life support and supplement them with a new and multilayered inquiry that seems to be only Katz-squared. Returning there, I worry, promises more trouble than help. Instead, I would look to a more traditional Fourth Amendment approach. Even if Katz may still supply one way to prove a Fourth Amendment interest, it has never been the only way. Neglecting more traditional approaches may mean failing to vindicate the full protections of the Fourth Amendment.

This is a big ruling and it will definitely affect how law enforcement approaches investigations. It will not be well-received by those used to tracking people via subpoena (rather than tail cars and surveillance teams). But it likely won't do much for Carpenter, who will almost certainly find good faith awarded to law enforcement's acquisition of his CSLI records. It will help going forward, but Carpenter will not be a beneficiary.

Filed Under: 3rd party doctrine, 4th amendment, carpenter, csli, location info, privacy, scotus, supreme court

Cops Wanting To Track Movements Of Hundreds Of People Are Turning To Google For Location Records

from the wherein-'probable-cause'-is-defined-as-'maybe-this-might-be-helpful? dept

Police in Raleigh, North Carolina are using Google as a proxy surveillance dragnet. This likely isn't limited to Raleigh. Google harvests an astounding amount of data from users, but what seems to be of most interest to law enforcement is location info.

In at least four investigations last year – cases of murder, sexual battery and even possible arson at the massive downtown fire in March 2017 – Raleigh police used search warrants to demand Google accounts not of specific suspects, but from any mobile devices that veered too close to the scene of a crime, according to a WRAL News review of court records. These warrants often prevent the technology giant for months from disclosing information about the searches not just to potential suspects, but to any users swept up in the search.

The good news is there are warrants in play. This likely isn't due to the PD's interest in "balancing civil rights with public safety," no matter what the government's frontmouths have stated to the press. The WRAL report includes a warrant request containing a footnote indicating Google pushed back when the cops showed up with a subpoena demanding info on everyone who had been in the vicinity of a crime scene.

The State of North Carolina maintains that the information sought herein consists entirely of "record[s]" other than the "content of communications…" Such records, require only a showing that there are reasonable grounds to believe the information sought is relevant and material to an ongoing criminal investigation… Despite this, Google has indicated that it believes a search warrant, and not a court order, is required to obtain the location data sought in this application. Although the Government disagrees with Google's position, because there is probable cause to believe the information sought herein will contain evidence of the criminal offenses specified in this affidavit, the Government is seeking a search warrant in this case.

But the bad news is that warrants are supposed to be tailored to specific searches related to specific suspects. These warrants are allowing law enforcement to obtain information on dozens or hundreds of people entirely unrelated to the criminal act being investigated, other than their proximity to the crime scene.

At least 19 search warrants issued by law enforcement in Wake County since 2015 targeted specific Google accounts of known suspects, court documents show.

But the March search warrants in the two homicide cases are after something different.

The demands Raleigh police issued for Google data described a 17-acre area that included both homes and businesses. In the Efobi homicide case, the cordon included dozens of units in the Washington Terrace complex near St. Augustine's University.

Cellphones -- and any other devices using Google products that serve up location info -- are steady generators of third party records. Conceivably, this puts a wealth of location info only a subpoena's-length away from the government. It appears Google is pushing back, but that tactic isn't going to work in every case. The Raleigh PD may have been willing to oblige Google to avoid a fight in court (and the risk of handing over information about how often it approaches third parties for records and what it demands from them), but not every PD making use of Google's location info stash is going to back down this easily.

Other warrants obtained by WRAL show local law enforcement has collected phone info and location data on thousands of people while investigating such crimes as arson and sexual battery. Despite having no evidence showing the perpetrators of these crimes even had a cellphone in their possession at the time the incidents occurred, agencies approached Google with judge-approved warrants to collect data on people living in nearby apartment units or visiting local businesses near the crime scene.

The government's attorneys believe everything is perfectly fine because no communications or other content is collected. But defense attorneys and rights advocates point out these warrants approach civil liberties from entirely the wrong direction, making everyone in the area a suspect before trimming down the list. In one way, it's a lot like canvassing a neighborhood looking for a suspect. But this analogy only holds if everyone officers approach is viewed as a suspect. This isn't the case in normal, non-Google-based investigations.

After five years as a Wake County prosecutor, Raleigh defense attorney Steven Saad said he's familiar with police demands for Google account data or cell tower records on a named suspect. But these area-based search warrants were new to him.

"This is almost the opposite technique, where they get a search warrant in the hopes of finding somebody later to follow or investigate," Saad said. "It's really hard to say that complies with most of the search warrant or probable cause rules that we've got around the country."

The Wake County District Attorney believes these warrants are solid enough to survive a challenge in court. The government may get its wish. Officers using these to obtain data will likely come out alright, thanks to good faith reliance on approved warrants, but the magistrates approving dragnet collection as an initial investigatory step may have some explaining to do.

The DA says it's just like watching business surveillance video when investigating a robbery. Lots of non-criminals will be captured on tape and their movements observed by officers. But the comparison fails because, in most cases, the criminal act will be caught on tape, limiting further investigation to the perpetrators seen by officers. In these cases, everyone with a cellphone within a certain distance of crime scene becomes a suspect whose movements are tracked post facto by officers who have no idea -- much less actual probable cause to believe -- that any of this data actually points to the suspect they're seeking.

Then there's the problem of effectiveness. Starting an investigation with a geofence and attempting to turn it into a bottleneck that will result in pursuable suspects doesn't seem to be working. According to the documents seen by WRAL, only one person has been arrested for any of the crimes in which police approached Google for data on thousands of users. And in that case, the location data law enforcement requested didn't show up until months after the suspect was charged. It may be there have been more success stories, but routine sealing of documents and warrants tends to make it impossible for anyone outside of the police department to know for sure. But the department knows. And if it has good things to say about this questionable search technique, it hasn't offered to share them with the rest of the public.

Filed Under: location info, north carolina, police, raleigh, surveillance, warrants
Companies: google