Federal Judge Gives Government Open-Ended Access To All Content In A Suspect's Gmail Account

from the a-warrant-is-NOT-a-permission-slip-to-violate-the-4th-Amendment dept

Even though the government hates to get warrants for searches, sometimes it has no choice. But just because there's a warrant involved doesn't mean the search will be any less invasive. Warrant applications are supposed to contain specifics about what is being sought and where it likely resides based on the sworn statements of investigators. Unfortunately, this often doesn't seem to be the case, especially when it comes to electronic data.

Two recent pushbacks by magistrate judges have sent the government back to its desk to rewrite overly vague warrant requests. (In one case, this resulted in 'judge shopping,' rather than a rewrite. The new judge was unimpressed.) Judges willing to make the government fine tune warrant requests are still a very small minority, however. The more common approach is exemplified by Judge Gabriel Gorenstein of the Southern District of New York.

A New York judge defended a controversial order that gave the government access to all content of the Gmail account of a target in a money laundering investigation, holding that courts have long recognized the practical need for law enforcement to seize documents if only to determine whether they fall within the warrant.

As John Ribeiro's article notes, other recent decisions have found that overly broad warrant requests are stretching the Fourth Amendment to the breaking point by not limiting the time period or scope of the electronic communications being sought. The government, on the other hand, has argued (with Gorenstein echoing) that seizing months of emails is no different than cloning an entire hard drive -- another common process deployed during criminal investigations. That it's no different doesn't suddenly make it more "right" or less of a violation of privacy.

Those other decisions (one of which Gorenstein refers to in his) had no noticeable effect on the approval of this warrant, which asked for everything… and got it.

The New York court, in contrast, granted on June 11 a warrant that permitted law enforcement to obtain emails and other information from a Gmail account, including the address book and draft mails, and to permit a search of the emails for certain specific categories of evidence.

Moving on from his "lesser of two wrongs" argument, Gorenstein added that allowing the service provider to return relevant communications would likely result in important information being overlooked.

"While an agent steeped in the investigation could recognize the significance of particular language in emails, an employee of the email host would be incapable of doing so," he wrote.

While this is likely true to some extent (the decision goes on to note that criminals often use codewords to discuss illegal activity -- something private company techs may not be versed in), the warrant itself is still highly problematic.

The court did not also place any limits on the manner or time frame in which the emails should be searched or retained.

So, the government will be given a suspect's entire email account and allowed to peruse it for anything for as long as it wants to.

As we've seen just recently, this is the sort of open-ended access the government shouldn't be given. In June, the Second Circuit Court returned a decision that said the government violated a person's Fourth Amendment rights by holding onto seized information for much longer than the period stated in the warrant. Not only did the feds dig through irrelevant information (after swearing in the warrant request that it wouldn't), it continued to do so until it came across something of possible interest to another federal agency (the IRS) and forwarded the data it supposedly wasn't digging through. Gorenstein's approved warrant contains no such safeguards, which means the feds literally can't go beyond the scope of the request. It's a blank check disguised as a nod to the Fourth Amendment.

The Fourth Amendment prohibits unreasonable searches and seizures. It does not go on to say "...unless you get a warrant." The warrant process is supposed to limit unreasonable searches and seizures by forcing law enforcement to detail (in a sworn statements) the specifics of what's being sought and the efforts that will be made to limit the seizure to the scope of the investigation. There's nothing "reasonable" about this open-ended request. Gorenstein's decision places ease of law enforcement access above Constitutional rights.

Filed Under: 4th amendment, email, gabriel gorenstein, sdny, warrants
Companies: google

Government Continues To Pretend People Use Cell Phones Simply To Create A Wealth Of Data For Law Enforcement To Access Without A Warrant

from the let's-make-government-cell-phone-data-accessible-by-FOIA-request dept

You'd think approved warrants must be like albino unicorns for all the arguing the government does to avoid having to run one by a judge. It continually acts as though there aren't statistics out there that show obtaining a warrant is about as difficult as obeying the laws of thermodynamics. Wiretap warrants have been approved 99.969% of the time over the last decade. And that's for something far more intrusive than cell site location data.

But still, the government continues to argue that location data, while possibly intrusive, is simply Just Another Business Record -- records it is entitled to have thanks to the Third Party Doctrine. Any legal decision that suggests even the slightest expectation of privacy might have arisen over the past several years as the public's relationship with cell phones has shifted from "luxury item/business tool" to "even grandma has a smartphone" is greeted with reams of paper from the government, all of it metaphorically pounding on the table and shouting "BUSINESS RECORDS!"

When that fails, it pushes for the lower bar of the Stored Communications Act to be applied to its request, dropping it from "probable cause" to "specific and articulable facts." The Stored Communications Act is the lowest bar, seeing as it allows government agencies and law enforcement to access electronic communications older than 180 days without a warrant. It's interesting that the government would invoke this to defend the warrantless access to location metadata, seeing as the term "communications" is part of the law's title. This would seem to imply what's being sought is actual content -- something that normally requires a higher bar to obtain.

But the government never stops defending its normal M.O.: as much as possible with as little paperwork (and judicial oversight) as possible. Here it is responding to a letter sent by defendant Aaron Graham, who has been battling for suppression of 221 days worth of cell site location data (including nearly 30,000 specific data points) the government obtained without a warrant during its investigation of his involvement in a series of robberies.

Graham's letter cited the recent 11th Circuit Court ruling in the US v. Davis case, which found that the government violated the defendant's Fourth Amendment rights by obtaining mobile tracking data without a warrant. (Unfortunately, Davis was not awarded a retrial as the government demonstrated the warrantless collection was obtained "in good faith.") The government's response to this ruling (and its possibly favorable effect on the defendant) simply advises the Fourth Circuit Court that the 11th Circuit Court got everything wrong. (via Mike Scarcella)

In requiring a warrant to obtain cell-site records, however, the Eleventh Circuit erred. The Eleventh Circuit asserted that there is “a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship,” 2014 WL 2599917 at *9-*10, but Fourth Amendment protection of information depends on how the government obtains information, rather than its nature.

So, rather than address the intricacies of the court's decision (that what used to be considered nothing more than "business records" are now very personal diaries of people's lives, thanks to the amount of data being gathered by cell providers), the government instead reiterates that it's entitled to warrantless access because it's always been entitled to warrantless access, technological advances and societal shifts be damned.

The government can obtain cell-site records with a 2703(d) order because they are business records stored at the provider’s discretion. See id. at 611-12. Bank records and dialed telephone numbers reveal far more sensitive, and far more particularized information than cell-site records, but no warrant is required to compel their disclosure.

Fair enough, but two things:

1) These "business records" are stored at the provider's discretion. Customers can't prevent the storage of certain records without forgoing service altogether. They also don't "reasonably" expect service providers to gather tons of data for law enforcement agencies to page through at their discretion. There's an expectation of privacy, albeit one that neither law enforcement nor service providers feel particularly compelled to address.

2) Shouldn't the question then be, why does law enforcement still have warrantless access to this "more sensitive" data, rather than, why doesn't law enforcement have more warrantless access?

Davis erred in distinguishing Miller and Smith by asserting that cell-site records are “not voluntarily disclosed.” 2014 WL 2599917 at *10. Smith assessed the information voluntarily disclosed from the standpoint of a well-informed customer, and cell phone companies inform customers that they collect location data.

The "well-informed customer" is hardly the average customer, and cell phone companies "disclose" plenty of info in pages and pages of fine print that no one ever reads. This shouldn't be taken to mean that customers are willingly generating a wealth of data for law enforcement to access at will. But the government reads all the fine print customers don't and chooses to believe every customer knows just how much info they're allowing law enforcement agencies to access without a warrant by simply turning on their cell phones. But the government's not done being disingenuous.

Moreover, when a business stores records at its discretion, it functions simply as a witness; the government may compel a witness to disclose records without a warrant regardless of whether the subject was aware the records were collected and stored.

This argument again tries to present the business collecting the records as the entity people should be directing their ire and astonishment at. If only these businesses didn't collect these records, then law enforcement wouldn't be able to access them. But much of what's collected is related to billing information, something these businesses don't collect voluntarily, but because it's essential to the business itself. People "consent" to this collection because the only way to opt out is to not use a phone. This hasn't been a practical option for several decades at this point. But the government continues to act as though people voluntarily generate evidence accessible without a warrant due to their insistence on using "optional" luxury devices. It's only very recently that the courts have started pushing back on this deliberately obtuse assertion, pointing out that circumstances have changed incredibly since the institution of the Third Party Doctrine, much less the Fourth Amendment itself.

Once again the question must be asked: what's so incredibly difficult about obtaining a warrant? In the case of Graham -- where over 200 days of cell site location data was acquired -- there obviously wasn't any timeframe concerns. And every law enforcement agency has built-in workarounds for exigent circumstances to be used in cases where time is of the essence. All of these arguments are the government aiming to maintain the status quo in the face of technological upheaval -- and with each passing day, the arguments seem a little more ignorant and petulant.

Filed Under: business records, law enforcement, mobile phones, privacy, third party doctrine, warrants

Australian Law Enforcement Agencies Join Their US Colleagues In Obtaining Cell Tower Data Dumps Without A Warrant

from the assume-any-country-with-cell-phones-and-law-enforcement-doing-the-same dept

How much call data do law enforcement agencies need? Here in the US, law enforcement utilize cell tower spoofers, cell tower data dumps and Hemisphere database searches to obtain call data, along with location information and whatever else can be gathered by these tools. These are all deployed without warrants, using the Third Party Doctrine loophole. No expectation of privacy in stored business records means no warrant is necessary.

But this isn't just an American thing. Other countries with cell towers and same sort of free-range access to "business records" are doing the same thing.

Australian federal and state police are ordering phone providers to hand over personal information about thousands of mobile phone users, whether they are targets of an investigation or not.

Fairfax Media has confirmed Australian law-enforcement agencies are using a technique known as a "tower dump", which gives police data about the identity, activity and location of any phone that connects to targeted cell towers over a set span of time, generally an hour or two.

Just like in the US, no warrant is required to access the call records of thousands of non-criminals and very little information is being provided as to how long these records are stored or what happens to them once the investigation is closed.

And just like in the US, no one wants to talk about them.

A NSW Police spokesman said it would "not comment" on its "operational capabilities".

Victoria Police wouldn't discuss tower dumps either, saying it did not comment on "police methodology".

And the Australian Federal Police also said it would not comment on its "technical capabilities".

Local telecoms have been a bit more forthcoming, but the statements lapse into the same rhetoric deployed by those doing the collecting.

"On occasion mobile network operators receive requests from Australian law-enforcement agencies to provide communications information from a specific tower," a Vodafone spokeswoman told Fairfax. "These requests usually cover short periods and the information provided is only metadata."

"Just metadata." Just that small thing that can give observers some very deep insight into your personal life, especially if location data is included.

"A request for non-content information on the use of a particular tower during a specified period of time may be lawful under certain circumstances," a Telstra spokeswoman said.

Well, I would hope that every time Telstra complied, it was only in those "certain circumstances" where it was "lawful." But if Australian telcos operate like American telcos, they've likely gone above and beyond what's requested several times and likely consider themselves to be "partners" in law enforcement and counterterrorism.

The Australian Attorney General's office provides a yearly report on law enforcement requests to telcos, but the report is about as useful as the government-hobbled "transparency reports" released by US companies. Cell tower dumps aren't separated from normal metadata requests and it's entirely unclear whether dump requests are treated as singular, despite the thousands of people potentially affected. According to the article, over 330,000 metadata requests were made to Australian telcos last year. The Greens Party spokesman for communications, Scott Ludlam, argues this transparency isn't nearly transparent enough.

"What we need is transparency as to what's being done and who is doing it," he said. "Ultimately I think we need a lawful warranting process to start to apply to [requests for data] like this..."

Considering thousands of users are affected by tower dumps, Ludlam argues that they should count for the number of those who are affected.

Providing details like this might result in more pushback from citizens, but it's more likely these numbers will never be handed over to the general public. Law enforcement agencies have argued for years (mostly successfully) that any sort of transparency about massive collections will expose "methods and means" and compromise not only ongoing investigations, but future investigations as well. And there will always be a certain contingent of legislators and judges who firmly believe that what the public doesn't know makes them safer.

Filed Under: australia, cell phone towers, information dump, mobile phones, privacy, warrants

US Courts' Wiretap Report Shows Wiretaps Are For Drugs And Warrants Are Rejected Only .03% Of The Time

from the so,-those-seven-were-like,-processing-errors-or-something? dept

The US Courts system has just released its annual report on wiretap warrants. As you'll recall, warrants are those quaint permission slips that law enforcement officers occasionally seek before performing searches. (Although it looks as though they'll be doing it more frequently from now on…)

Not included in this report are outlying actions by agencies whose rogueness has been codified. The US Courts FAQ on the report points out that data from the FISA court is not included. Presumably, the previously illegal warrantless wiretaps deployed by the federal government aren't being tracked either, because if there's no warrant, there's no court. And if there's no court, there's no oversight.

Also not included are pen register/trap and trace orders, which are basically given the same amount of scrutiny that subpoenas and NSLs are given: very little, if any.

No report to the AO is required for the use of a pen register (a device attached to a telephone line that records or decodes impulses identifying the numbers dialed from that line) unless the pen register is used in conjunction with any wiretap devices whose use must be recorded. No statistics are collected on the number of devices used in conjunction with each order.

The US Courts system has handily provided ten years of data on wiretap warrants and everything in it points to one thing -- US law enforcement is almost exclusively focused on fighting the War on Drugs.

Of the 22,741 warrants issued since 2003, 21,838 (96%) were issued under the heading of "Narcotics." And the warrants themselves are ridiculously easy to obtain (giving lie to law enforcement's complaints about the complexity of securing a search warrant). To obtain these 22,741 warrants, 22,748 applications were submitted. Only 7 applications have been rejected since 2003, giving law enforcement a batting average of .99969.

So, we know drugs are big business for law enforcement. At an average of $41,119 per intercept deployed, expenses for just the drug-related wiretaps in 2013 easily tops the $100,000,000 mark, and that's assuming all of those adhered to that average (the average was taken from 2,069 wiretaps where costs were reported.) The cost per intercept seems to be coming down (it was over $62,000 in 2003) but the number of intercepts has doubled over the same time period. The US Courts' information page also notes that further expenses are often reported after the reporting period has ended. (It points to an additional $62 million in expenses reported in 2013 for wiretaps issued in previous years.) Drugs are not just a multi-billion dollar business for distributors. With this intense focus on one particular form of crime, law enforcement has become just as big a "customer" of the drug business as drug users.

That data may not be particularly surprising, but it does reveal just how much attention is being paid to a narrow range of criminals. Nowhere does the report indicate anything has been deployed to combat terrorism, which is often the stated reason for obtaining bigger and better ex-military weapons and vehicles. It could be that wiretaps issued for counterterrorism are hidden under other designations or done without court approval. Or it could be that there's simply not nearly as much domestic terrorism activity as law enforcement officials claim.

The more surprising data, especially when coupled with the fact that US courts have only rejected .00031 of the wiretap applications that cross their desks, is the sheer number of people and communications being swept up by single warrants.

San Mateo County, California had only one wiretap warrant issued (probably related to the investigation of Sen. Leland Yee), but it was able to put a whole lot of people under surveillance with that single document. Its single intercept gathered communications from 588 people, with a total of 19,477 interceptions… of which only 513 proved to be incriminating. (It should be noted that intercepted communications can also include text messages, a form of communication that can easily cause these numbers to swell to ridiculous proportions.)

Likewise, Franklin County, Ohio also sought only one wiretap order, but it, too, had a huge payoff -- 551 people, 9,654 communications with 454 deemed incriminating (most likely related to this drug bust).

But with all these large numbers and expenses come massive amounts of arrests and indictments, right?

Well, not really. Even accounting for the fact that it can take years before the results of an investigation result in jail time, the percentage of convictions resulting from wiretap-related arrests seems to be hovering right around 45%. And the number of arrests is far smaller than number of people whose communications were intercepted during the course of the investigation.

In 2003, 167,272 people had their communications tapped (with 4.3 million communications intercepted) but this has only resulted in (to date) 5,705 arrests and 2,523 convictions. 2004 was even worse, with 215,460 people surveilled (5.1 million communications intercepted). The end result, a decade on? 6,717 arrests and 2,815 convictions.

If these patterns hold (and there's no evidence they won't), the hit rate of wiretap deployments will continue to fall, at least in terms of arrests and convictions. The average number of people tapped by an order last year was "only" 97 (the number has hovered between 100-110 over the course of the last decade) but the average number of communications harvested from each wiretap has been increasing over the past several years. Last year, it was 4,558 communications per wiretap (2003/2004 were 3,004/3,017 per) and the number of wiretaps issued has more than doubled in that same period. 2013's numbers are astounding: 346,872 people surveilled with 16,299,408 communications intercepted, with less than 3 million declared "incriminating."

Within those numbers is another interesting fact: encryption is rarely used and even when it is, it's rarely effective.

The number of state wiretaps in which encryption was encountered increased from 15 in 2012 to 41 in 2013. In nine of these wiretaps, officials were unable to decipher the plain text of the messages. Encryption was also reported for 52 state wiretaps that were conducted during previous years, but reported to the AO for the first time in 2013. Officials were able to decipher the plain text of the communications in all 52 intercepts.

Contrast this minimal number with the thousands of devices tapped with the claim made by the US government (in the US v. Wurie warrantless cell phone search case) that requiring warrants would put law enforcement at the mercy of tech-savvy criminals.

[S]earching an arrestee's cell phone immediately upon arrest is often critical to protecting evidence against concealment in a locked or encrypted phone or remote destruction.The numerous party and amicus briefs in these cases have not seriously undermined that fundamental practical point. Although the briefs identify various techniques to prevent the remote-wiping problem (none of which is close to perfect), they barely address the principal problem that the government identified: automatic passcode-locking and encryption.

There is no tech arms race. Encryption was encountered 41 times durings the states' surveillance of over 200,000 people. The encryption "held" only nine times. All fifty-two times the federal government encountered it during its surveillance of millions of people over the last several years, it was able to defeat it.

The US Court system has proven indistinguishable from the FISA Court with its approval rate that's only .03% away from 100%. Likewise, the surveillance it approves sweeps up tons of "incidental" communications from completely innocent parties. The end result, however, is possibly more futile than the War on Terror. The Drug War isn't headed for a win, nor will it ever be. It will never even be a tie. This has gone on for 40 years and the only "benefit" has been increased budget lines for law enforcement agencies and the steady militarization of local police forces. Billions of dollars in taxes are being poured into a battle many Americans don't feel is worth fighting, while the system itself remains largely insulated against public opinion. Judges are granting nearly anything as long as the word "drugs" appears on the request and law enforcement agencies know this.

If nothing else, this reports shows that law enforcement should never have a problem with seeking a warrant. Even large-scale surveillance efforts (like the sweeping up the communications of 500+ people with a single wiretap request) are flying through the court system without a hitch.

Filed Under: drugs, law enforcement, rubber stamp, us courts, warrants, wiretaps

FBI, CIA Use Backdoor Searches To Warrentlessly Spy On Americans' Communications

from the but-of-course dept

The other shoe just dropped when it comes to how the federal government illegally spies on Americans. Last summer, the details of the NSA's "backdoor searches" were revealed. This involved big collections of content and metadata (so, no, not "just metadata" as meaningless as that phrase is) that were collected under Section 702 of the FISA Amendments Act (FAA). This is part of the program that the infamous PRISM effort operates under, and which allows the NSA to collect all sorts of content, including communications to, from or about a "target" -- where a "target" can be incredibly loosely defined (i.e., it can include groups or machines or just about anything). The "backdoor searches" were a special loophole added in 2011 allowing the NSA to make use of "US person names and identifiers as query terms." In the past, it had been limited (as per the NSA's mandate) to only non-US persons.

This morning, James Clapper finally responded to a request from Senator Ron Wyden concerning the number of such backdoor searches using US identifiers that were done by various government agencies. And, surprisingly, it's redaction free. The big reveal is... that it's not just the NSA doing these searches, but the CIA and FBI as well. This is especially concerning with regards to the FBI. This means that the FBI, who does surveillance on Americans, is spying on Americans communications that were collected by the NSA and that they're doing so without anything resembling a warrant. Oh, and let's make this even worse: the FBI isn't even tracking how often it does this. It's just doing it willy nilly:

The FBI does not track how many queries it conducts using U.S. person identifiers. The FBI is responsible for identifying and countering threats to the homeland, such as terrorism pilots and espionage, inside the U.S. Unlike other IC agencies, because of its domestic mission, the FBI routinely deals with information about US persons and is expected to look for domestic connections to threats emanating from abroad, including threats involving Section 702 non-US. person targets. To fulfill its mission and avoid missing connections within the information lawfully in its possession, the FBI does not distinguish between U.S. and non- U.S. persons for purposes of querying Section 702 collection. It should be noted that the FBI does not receive all of Section 702 collection; rather, the FBI only requests and receives a small percentage of total Section 702 collection and only for those selectors in which the FBI has an investigative interest.

Moreover, because the FBI stores Section 702 collection in the same database as its "traditional" FISA collection, a query of "traditional" FISA collection will also query Section 702 collection. In addition, the FBI routinely conducts queries across its databases in an effort to locate relevant information that is already in its possession when it opens new national security investigations and assessments. Therefore, the FBI believes the number of queries is substantial. However, only FBI personnel trained in the Section 702 minimization procedures are able to View any Section 702 collection that is responsive to any query.

Got that? Basically, the FBI often asks the NSA for a big chunk of data that the NSA probably shouldn't have in the first place -- including tons of Americans' communications, and the FBI gets to dump it into the same database that it is free to query. And the FBI tracks none of this, other than to say that it believes that there are a "substantial" number of such queries. This would seem to be a pretty blatant attempt to end run around the 4th Amendment, giving the FBI broad access to searching through the communications of Americans with what appears to be almost no oversight.

Yikes!

Oh, and it's not just the NSA, but the CIA as well. Remember, the CIA is not supposed to be doing any surveillance on US persons (like the NSA), but that's not what's happening at all. At least the CIA tracks some (but not all) of its abuse of backdoor searches:

In calendar year 2013, CIA conducted fewer than 1900 queries of Section 702-acquired communications using specific U.S. person identifiers as query terms or other more general query terms if they are intended to return information about a particular U.S. person. Of that total number approximately 40% were conducted as a result of requests for counterterrorism-related information from other U.S. intelligence agencies. Approximately 27% of the total number are duplicative or recurring queries conducted at different times using the same identifiers but that CIA nonetheless counts as separate queries. CIA also uses U.S. person identifiers to conduct metadata-only queries against metadata derived from the FISA Section 702 collection. However, the CIA does not track the number of metadata-only queries using U.S. person identifiers.

So, the CIA is doing these kinds of warrantless fishing expeditions into the communications of Americans as well, but at least the CIA tracks how often it's doing so. Of course, when it comes to metadata searches, the CIA doesn't bother. It's also a bit bizarre that the CIA is apparently carrying out a bunch of those searches for "other U.S. intelligence agencies," when the CIA should be especially limited in its ability to do these searches in the first place.

Senator Wyden has responded to these revelations by pointing out how "flawed" the oversight system is that these have been allowed:

When the FBI says it conducts a substantial number of searches and it has no idea of what the number is, it shows how flawed this system is and the consequences of inadequate oversight. This huge gap in oversight is a problem now, and will only grow as global communications systems become more interconnected. The findings transmitted to me raise questions about whether the FBI is exercising any internal controls over the use of backdoor searches including who and how many government employees can access the personal data of individual Americans. I intend to follow this up until it is fixed.

Hopefully, now you are starting to recognize what a big deal it was last week when the House of Representatives recently voted to defund the ability to do these kinds of backdoor searches. Still, much more needs to be done.

Oh, and in case you're wondering why Clapper finally 'fessed up to the FBI and CIA making use of these data to warrantlessly spy on Americans, it's worth noting that the Privacy and Civil Liberties Oversight Board (PCLOB) is expected to come out with its report on the Section 702 surveillance program on July 2nd (7/02, get it?). It seems likely that the report will discuss these backdoor searches on Americans and how other agencies besides the NSA has been involved in the practice.

Filed Under: 4th amendment, backdoor searches, cia, fbi, fisa, james clapper, nsa, privacy, ron wyden, section 702, surveillance, warrantless, warrants

Facebook Fighting Against Massively Broad Warrant From NY District Attorney For All Information From 381 Accounts

from the 4th-amendment? dept

Last week, after finally having a gag order lifted by a court, Facebook revealed how it had spent the last year fighting back against an incredibly broad search warrant from the Manhattan District Attorney's office, for basically all information -- including private messages -- from 381 user accounts. The warrant came complete with a gag order forbidding the company from telling anyone -- including the 381 people -- about the search. The searches were related to an investigation that resulted in charges being filed against over 100 former NYC police and firefighters for a giant disability fraud scheme. Basically, those retired officers faked disabilities, while their Facebook accounts supposedly revealed that their disability claims were bogus. While we're all for rooting out former government employees clearly abusing the system, we're even more worried about overly broad government intrusions like this.

Part of the issue, though, is over who has standing. As you may recall, Twitter was involved in a somewhat similar situation a few years back, when it went to court to protect the private messages of Malcolm Harris, who was involved in some Occupy Wall St. protests. In that case, Twitter told Harris, and Harris objected, but the court said it was only an issue between the government and Twitter, so Harris had no standing. Twitter then fought the issue, but eventually lost. The details in this case are a bit different (including the type of request -- a search warrant, rather than a 2703(d) order in Twitter's -- case, but the basic principles are fairly similar.

Unfortunately, the law is a bit of a mess on this issue, again getting to the difficulty of applying old laws to new technologies:

Orin S. Kerr, a law professor at George Washington University who is an expert on digital searches and seizures, said Facebook was trying to do something unusual in establishing a right for service providers to challenge a warrant. “The real question is, ‘Can they challenge warrants for their customers?’ And I think the answer is probably not, under current law,” Mr. Kerr said.

While some have made comparisons to last week's Supreme Court ruling on mobile phone searches, which recognized that the digital data you store on your phone and "in the cloud" are more like the personal effects you have in your house, it's unlikely that ruling will have much of an impact here. After all, the point of that case was to tell law enforcement to "get a warrant." And, in this case, that's exactly what the DA's office did.

The bigger question may be one of due process and standing in terms of challenging these warrants. As Facebook's deputy general counsel, Chris Sonderby, explains:

Of the 381 people whose accounts were the subject of these warrants, 62 were later charged in a disability fraud case. This means that no charges will be brought against more than 300 people whose data was sought by the government without prior notice to the people affected. The government also obtained gag orders that prohibited us from discussing this case and notifying any of the affected people until now.

We’ve gone to court and repeatedly asserted that these overly broad warrants–which contain no date restrictions and allow the government to keep the seized data indefinitely–violate the privacy rights of the people on Facebook and ignore Fourth Amendment safeguards against unreasonable searches and seizures. We fought forcefully against these 381 requests and were told by a lower court that as an online service provider we didn’t even have the legal standing to contest the warrants. We complied only after the appeals court denied our application to stay this ruling, and after the prosecutor filed a motion to find us in criminal contempt.

In talking to the NY Times, Sonderby elaborated that when the DA's office said that the individuals themselves would have standing to challenge the use of the collected evidence later, that left out all of the people whose information was taken, but who weren't charged. To them, they just had their private effects searched with no recourse.

“It appeared to us from the outset that there would be a large number of people who were never charged in this case,” he said. “The district attorney’s response was that those people would have their day in court. There are more than 300 people that will never have that chance.”

In some ways, this case is a bit trickier than others. When there's probable cause, allowing law enforcement to get a warrant and do a search, makes sense. The real problem here is the incredibly broad nature of the warrants in this case, and the fact that there's really no way to challenge that factor. Facebook has basically been told it can't challenge it. The 300 people who aren't charged have no way of challenging it. And those that were charged really can only challenge the situation involving their personal circumstances, rather than the overly broad nature of the original warrant.

It seems worth pointing out, by the way, that the warrant happened last July, about a month after the first Snowden revelations. While Facebook notes that it was the massive size of the warrant (more than 10x larger than any previous one) that made the company challenge it, it seems quite likely that the sudden attention on internet companies and their willingness to share personal information with the government played a big role in the decision as well. Chalk another one up to the Snowden Effect.

Filed Under: disability fraud, ny, ny district attorney, privacy, standing, surveillance, warrants
Companies: facebook

Law Enforcement, DOJ Already Plotting How To Get Around Supreme Court's Warrant Requirement To Search Phones

from the because-of-course-they-will dept

Following this week's landmark ruling from the Supreme Court that says law enforcement must get a warrant to search mobile phones, law enforcement folks are clearly freaking out. A bunch of folks are quoted on how "awful" this ruling is, as they pretend that getting a warrant is such an incredible burden. Jim Pasco, the executive director of the Fraternal Order of Police, points out that due process should be ignored when gangs are around:

Jim Pasco, executive director of the Fraternal Order of Police, the country's largest police union, imagined the police busting a drug deal with two suspects, one who gets cuffed and another who gets away.

The arresting officers “want to get into that phone and see if they can get the other guy,” he said in an interview. “Or gang situations. They communicate almost exclusively by phone. There's more at stake here than due process. It's public safety.”

Meanwhile, another police spokesperson overreacts by suggesting warrants are somehow difficult to get:

Besides the delay, one problem is such a warrant might not be approved, said Bill Johnson, executive director of the National Association of Police Organizations, which counts about 240,000 rank-and-file police officers as members.

“You have to make that jump: I bet he's got a bunch of stuff on his phone. And that's not good enough,” he said. “The officers are really going to have to point to something specific that ties that phone or that suspect's use of phones to the commission of a crime.”

He makes that sound horrible, but that's what the Constitution says. Just because there may be bad stuff in someone's house the police don't get to just search it. They have to point to something specific. That's the 4th Amendment. Has Johnson never read it?

Meanwhile, at the DOJ, they're already plotting on ways to get around this ruling by seeing how far they can push the "exigent circumstances" exception:

Ellen Canale, a Justice Department spokeswoman, said the agency would work with law enforcement to ensure "full compliance" with the decision.

"We will make use of whatever technology is available to preserve evidence on cell phones while seeking a warrant, and we will assist our agents in determining when exigent circumstances or another applicable exception to the warrant requirement will permit them to search the phone immediately without a warrant," Canale said.

Notice how the focus is on figuring out more ways to search phones, not more ways to make sure they obey the law. This doesn't make me feel any safer. Quite the opposite.

Filed Under: 4th amendment, doj, exigent circumstances, law enforcement, privacy, riley, supreme court, warrants

Reps. Goodlatte And Ruppersberger Admit That NSA Is Warrantlessly Spying On Americans' Communications

from the well,-there-you-go... dept

We've already written about the surprising, but encouraging, vote late last night to defund backdoor searches by the NSA. But it's worth looking at some of the floor debate on the amendment last night -- in particular the push against the amendment from Reps. Goodlatte and Ruppersberger, who both appear to flat out admit that the NSA does warrantless spying on Americans' communications, in direct contrast to earlier claims. The reasons for these two to argue against the amendment are clear. Goodlatte was the guy who negotiated the "deal" with the White House and the House Intelligence Committee to completely water down the USA Freedom Act, and he knows that this amendment puts some of the substance that he stripped out right back in. Ruppersberger, of course, represents the district where the NSA is headquartered, and is the ranking member for the House Intelligence Committee. His loyalty to the NSA over the American public has always been clear. But to have them basically admit that the NSA does warrantless spying on Americans is quite impressive. Here are both of them arguing against the amendment: Goodlatte kicks it off by whining about how this undoes the "carefully negotiated compromise" in the USA Freedom Act. He leaves out that "carefully negotiated" was what happened after the markup, completely changing the nature of the bill. However, in describing the "existing minimization procedures," he notes (correctly) that the NSA isn't supposed to do searches on Americans, but then puts in the all-important "except" which undermines the whole thing and shows that the NSA is (contrary to the law) spying on the communications (not metadata) of Americans:

HR 3361 [the USA Freedom Act] also prohibits the government from using communications to or from a United States person or a person who appears to be located in the United States EXCEPT where the communication relates to a target under Section 702 or to protect against an immediate threat to human life.

Yeah, that's a pretty big "except." Remember, the NSA is not supposed to ever look at communications by anyone inside the US or an American citizen abroad without a warrant. Yet, Goodlatte flat out admits that the NSA does exactly that if the communications (again, not just metadata) "relate to a target." Now, remember, in discussing this how we recently highlighted that "relate to a target" means any communication about a target? In other words, Goodlatte is more or less admitting that if you merely mention Al Qaeda or Osama bin Laden in an email, the NSA has the right to read your email without a warrant. That's the backdoor search that so many people have been concerned about, which very clearly violates the 4th Amendment's requirement for a warrant. And here is Goodlatte pretending it's no big deal.

Goodlatte then notes that the NSA can't use Section 702 to "target" a US person, but that's misleading. Because the NSA can collect communications "to" "from" or "about" a target, it means that tons of communications (again, not just metadata) by US persons are being spied on by the NSA entirely without a warrant. And this gets bigger and bigger when the "target" is defined broadly.

Then Ruppersberger jumps in to add his "thoughts" on the amendment. He too flat out lies, and claims that the USA Freedom Act was a one-year process of "carefully considered negotiation and debate." That's not even remotely accurate. The original was left to sit and dangle until it appeared that there might be enough support for it, and then frantic negotiations took place to water it down before the markup. Then, after the markup, the White House stepped in and watered it down even further at the very last minute, so that most of those voting on it had no idea what was actually in it, and how it stripped out nearly every thing that "limited" the NSA. Then, he too, admits how it allows for warrantless spying on Americans, by spewing FUD about bomb threats in the US:

It makes our country less safe. It would prohibit the urgent search of lawfully collected information to thwart a bomb threat against a synagogue in Los Angeles, a church in Maryland or the New York Stock Exchange.

In other words, contrary to the claims before, Ruppersberger is directly admitting that it's used to spy on communications in the US. And, again, it wouldn't prohibit searches with a warrant, which are (contrary to what some claim) not that difficult to get.

Five minutes later, Goodlatte speaks again, and this time he's much angrier than before (perhaps having received some advanced warning that this amendment was going to pass overwhelmingly): He kicks it off by saying that the USA Freedom Act "honors the 4th Amendment." But then goes on a FUD brigade, listing out a bunch of angry claims about terrorists in the middle east and how they want to attack us. Then there's the inevitable claims about how "the terrorism threat is growing" (which kind of undermines the claims that all this intelligence has been useful, no?), and ridiculously argues that this amendment "creates a blind spot" for the intelligence community. It does not. It just says that you need to have an actual warrant for spying on the communications of US persons, meaning that they can't just sweep up every email of every person who obliquely references "a target." Then, once again, he effectively admits that this is about spying on Americans:

[It would] create an impediment to the government's ability to locate threat information already in its possession.

This is misleading, but revealing. All the amendment did was say that the NSA can't do searches on the communications of US persons. The "impediment" is merely making sure that the NSA obeys the law which says it cannot spy on the communications of US persons without a warrant. By arguing that this creates an impediment to "threat information already in its possession," Goodlatte is admitting that the NSA is collecting communications of Americans without a warrant.

So, yeah, the next time someone argues that the NSA is either (a) not spying on Americans or (b) not spying on the actual content of communications, you might want to point them at these clips, in which two of the bigger NSA defenders have admitted that, in fact, that's exactly what the NSA does.

Filed Under: 4th amendment, bob goodlatte, dutch ruppersberger, massie amendment, nsa, section 702, surveillance, warrantless surveillance, warrants

More Than Half Of The House Co-Sponsoring Email Privacy Reform; So Why Isn't It Moving?

from the ecpa-reform-now dept

For quite some time we've talked about the importance of ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is woefully outdated. Passed in the 1980s, when the internet was just a small network that connected a few universities, it has allowed law enforcement and other government officials to snoop on your email based on some very outdated definitions and assumptions. As we've discussed in the past, one very obvious example, is the idea that, under the law, emails stored on a server for over 180 days are considered "abandoned" and that there's no need to get a warrant to view those emails. Of course, that was back when people expected old emails to be either deleted or downloaded. No one predicted "cloud" computing with virtually unlimited storage.

For years now, there's been a major effort at ECPA reform, to actually make sure that law enforcement needs a warrant to view your emails. It has had strong support in Congress for some time, but the main folks fighting against it are the SEC and the IRS, who like the fact that they can search through your emails without a warrant. In fact, the SEC seems to revel in its ability to do some very questionable things, in part thanks to ECPA.

Earlier this week, the main ECPA reform bill in the House, sponsored by Reps. Kevin Yoder and Jared Polis, hit a new milestone: it currently has 218 co-sponsors, meaning that more than half of the House now has their name on the bill. And yet, the bill is still stalled out, because House leadership has been scared off by the SEC and IRS. Hopefully, the House will finally move forward on this bill.

And while Yoder notes in that article that the NSA revelations have actually helped give this bill momentum, it's important to note that this is separate from the NSA reform issue. ECPA reform is unrelated to the NSA stuff, but covers what other government agencies can do with your email. Both are important issues, but it would be great to finally get basic ECPA reform through. This is a fight that's been going on for over a decade, and with more than half the House supporting it, how much longer can Congressional leadership ignore it?

Filed Under: 4th amendment, ecpa, ecpa reform, irs, jared polis, kevin yoder, privacy, sec, warrants

Court Says Feds Violated 4th Amendment By Holding Onto Suspect's Computer Data Too Long

from the hey-the-4th-amendment-still-exists dept

Yet another court has remembered that the 4th Amendment exists. The Second Circuit appeals court has ruled that the government violated the 4th Amendment rights of Stavros Ganias when it held onto data it had seized (legally) from his computers for longer than the warrant in question allowed. In executing the warrant, Army investigators (Ganias was providing tax and accounting services to a couple of companies providing security to the Army at a vacant facility, and there were allegations that people at one of the companies was stealing copper wire from the facility and also playing some games with billing) made copies of Ganias' computer hard drives -- including files "beyond the scope of the warrant" such as his personal financial records.

While Ganias objected to the collection of such files as it was happening, he was told investigators were only concerned with the specific case at hand and would get rid of the other files. Take a guess what didn't happen? Yeah, they hung onto those files, and then in searching them, found some other stuff of interest and passed all of the files along to the IRS. While they claim that they focused on the files the warrant covered, they refused to delete the other files:

They did not, however, purge or delete the non-responsive files. To the contrary, the investigators retained the files because they "viewed the data as the government's property, not Mr. Ganias's property." Their view was that while items seized from an owner will be returned after an investigation closes, all of the electronic data here were evidence that were to be protected and preserved. As one agent testified, "[W]e would not routinely go into DVDs to delete data, as we're altering the original data that was seized. And you never know what data you may need in the future. . . . I don't normally go into electronic data and start deleting evidence off of DVDs stored in my evidence room." The computer specialists were never asked to delete (or even to try to delete) those files that did not relate to IPM or American Boiler.

Now take a guess what happened? After digging deeper into the original files, the IRS suddenly began to suspect Ganias himself of cooking some books, and decided it wanted to look at his personal financial records which, conveniently, were right there in the collection of documents they were never supposed to have or look at. To their (slight) credit, the IRS recognized it couldn't just search those files, and so got another warrant to go through them. However, it only had them because it had sat on them for two and a half years, and Ganias insists that the original files had been changed soon after the Army's copying of his hard drives. At trial, Ganias was convicted, but the appeals court has trouble with the 4th Amendment implications. After going through a quick history of the 4th Amendment it notes (thankfully) that these concepts still apply in the computer age.

These Fourth Amendment protections apply to modern computer files. Like 18th Century "papers," computer files may contain intimate details regarding an individual's thoughts, beliefs, and lifestyle, and they should be similarly guarded against unwarranted Government intrusion. If anything, even greater protection is warranted....

It also notes that with so much stuff stored on computer, sometimes this gets tricky:

Not surprisingly, the ability of computers to store massive volumes of information presents logistical problems in the execution of search warrants. It is "comparatively" commonplace for files on a computer hard drive to be "so intermingled that they cannot feasibly be sorted on site."... As evidenced by this case, forensic analysis of electronic data may take months to complete. It would be impractical for agents to occupy an individual's home or office, or seize an individual's computer, for such long periods of time. It is now also unnecessary. Today, advancements in technology enable the Government to create a mirror image of an individual's hard drive, which can be searched as if it were the actual hard drive but without interfering with the individual's use of his home, computer, or files.

The court notes that creating such a mirror image is okay... but there are limits on what can be done with the seized data. By hanging onto all his records indefinitely, the court found that it interfered with his 4th Amendment rights.

The Government's retention of copies of Ganias's personal computer records for two-and-a-half years deprived him of exclusive control over those files for an unreasonable amount of time. This combination of circumstances enabled the Government to possess indefinitely personal records of Ganias that were beyond the scope of the warrant while it looked for other evidence to give it probable cause to search the files. This was a meaningful interference with Ganias's possessory rights in those files and constituted a seizure within the meaning of the Fourth Amendment.

[....] The Government had no warrant authorizing the seizure of Ganias's personal records in 2003. By December 2004, these documents had been separated from those relevant to the investigation of American Boiler and IPM. Nevertheless, the Government continued to retain them for another year-and-a-half until it finally developed probable cause to search and seize them in 2006. Without some independent basis for its retention of those documents in the interim, the Government clearly violated Ganias's Fourth Amendment rights by retaining the files for a prolonged period of time and then using them in a future criminal investigation.

As for the government's argument that once they have these files they're now "government property," the court rejects that pretty quickly.

As explained above, practical considerations may well justify a reasonable accommodation in the manner of executing a search warrant, such as making mirror images of hard drives and permitting off-site review, but these considerations do not justify the indefinite retention of non-responsive documents.... Without a warrant authorizing seizure of Ganias's personal financial records, the copies of those documents could not become ipso facto "the government's property" without running afoul of the Fourth Amendment

The court also rejects a variety of other attempts by the government to get around this, including the fact that Ganias had not earlier brought a motion to "return" the property. Apparently that was convincing to the lower court, but not so here.

Imposing such a prerequisite makes little sense in this context, where Ganias still had the original computer files and did not need the Government's copies to be returned to him. Moreover, we fail to see what purpose a Rule 41(g) motion would have served, given the Government's position that non-responsive files in its possession could not feasibly have been returned or purged anyway.

In the end, the court outlines how troubling the government's position is in this case:

The Fourth Amendment was intended to prevent the Government from entering individuals' homes and indiscriminately seizing all their papers in the hopes of discovering evidence about previously unknown crimes.... Yet this is exactly what the Government claims it may do when it executes a warrant calling for the seizure of particular electronic data relevant to a different crime. Perhaps the "wholesale removal" of intermingled computer records is permissible where off-site sorting is necessary and reasonable,... but this accommodation does not somehow authorize the Government to retain all non-responsive documents indefinitely, for possible use in future criminal investigations.

There's a separate issue also in the case, concerning a juror commenting (negatively) on the case on Facebook during the case (and also friending another juror on Facebook), but the court didn't seem to concerned about that, rather suggesting that courts should be a bit more upfront with jury instructions to avoid that sort of thing.

Either way, while a very specific issue, it's a nice 4th Amendment win.

Filed Under: 4th amendment, irs, second circuit, seized data, stavros ganias, warrants