EFF, ACLU Sue Government Over Warrantless Electronic Searches At The Border

from the still-in-US-territory,-but-none-of-your-rights-apply dept

If all goes well, we might have the US border join the rest of the United States in recognizing citizens' Fourth Amendment rights. The Supreme Court's Riley decision made it clear law enforcement needed to obtain warrants before searching people's cellphones. Unfortunately, the so-called "border exception" -- upheld by at least one court -- says securing the border is more important than recognizing people's rights.

The EFF and ACLU -- along with the 10 US citizens and one permanent resident they're representing -- are suing DHS, CBP, and ICE for violating the Constitutional rights of the plaintiffs by warrantlessly searching their devices. Not only did the government search their devices, but in some cases, held onto the devices for weeks. One plaintiff's phone is still in the hands of the CBP, having originally been taken from the plaintiff in January.

The filing [PDF] provides details of the plaintiffs' interaction with government agents at US borders. All plaintiffs were taken to secondary screening where they were coerced into handing over their devices and, in some cases, passwords. This is all being done with zero articulable suspicion or probable cause. Agents imply devices will be returned sooner if those they've detained are compliant. But even complicity can result in citizens having to leave their devices in the hands of the government.

Even when travelers comply with officers’ demands to unlock their devices or provide their device passwords, officers sometimes confiscate the devices anyway. For example, even though Ms. Alasaad provided the password to her phone, and CBP officers had already searched Mr. Alasaad’s unlocked phone, officers still confiscated both of the couple’s phones. CBP kept both phones for approximately 15 days.

These lengthy device confiscations cause significant harm. Many travelers, including Plaintiffs, rely on their electronic devices for their work and livelihoods, as well as for communicating with family members. Losing access to electronic devices and the information they contain for extended periods of time can disrupt travelers’ personal and professional lives. Confiscation of electronic devices is especially harmful to those who need, but do not have or cannot afford, replacement devices, and those who need but did not back up stored data.

As a result, the plaintiffs have spent thousands of dollars replacing devices the government kept without offering a legitimate law enforcement/national security reason for doing so. As the lawsuit points out, this type of behavior is unconstitutional.

When CBP and ICE officers confiscate electronic devices pursuant to their policies and practices for the purpose of searching those devices’ content, such confiscations violate the Fourth Amendment in at least three distinct ways:

a. First, these confiscations are not justified at their inception when they are affected absent probable cause.

b. Second, these confiscations are excessive in scope, because officers confiscate not just the locked devices they are unable to search at the port of entry, but also the unlocked devices they are able to search and that they sometimes have already searched.

c. Third, these confiscations are excessive in duration where the duration of confiscation of locked devices is unreasonable in relation to the time actually needed to search the devices.

In addition to the Fourth Amendment violations, there are also concerns about the First. A few of those participating in this lawsuit are journalists. CBP officers not only searched their phones, but questioned them directly about sources and subjects.

Even the plaintiffs who aren't journalists have valid First Amendment complaints. If the government's going to demand access to writings, photos, videos, and other forms of expression stored on electronic devices, this limits future expressive acts. People whose devices have been seized and searched are less likely to give the government as much to dig through the second time around. This means less writing, fewer photos, and steering clear of any artistic creation the government might somehow misconstrue as threatening, criminal, or simply critical of rote government abuse.

As the plaintiffs point out, these searches aren't Constitutional, but they are allowed by DHS and CBP policies -- which state agents may search and seize phones without reasonable suspicion. To that end, the lawsuit asks the court to find the policies officially unconstitutional and ban the government from searching devices at the border without a warrant.

It's a long shot, given the judicial branch's general deference to all things national security-related. But it will be nice to see the government explain how the Supreme Court's Riley decision somehow doesn't apply to American citizens just because they're entering or leaving the country.

Filed Under: 1st amendment, 4th amendment, border exception, border searches, cbp, computers, doj, ice, phones, warrantless searches
Companies: aclu, eff

Oregon Cop's Inability To Keep His Hands Off A Resident's Phone Costs Taxpayers $85,000 In Legal Fees

from the stop-touching-other-people's-stuff dept

Oregon residents will be opening up their wallets and handing out $85,000 to a citizen and her ACLU representation, thanks to a police officer being the only cop on the scene unable to handle being filmed while effecting an arrest.

Carrie Medina sued the city of Portland in early 2015 after an officer seized her camera and ended her livestream of an arrest two years earlier. The lawsuit [PDF], filed by the ACLU, contains the full conversation between Officer Taylor Letsis and Medina during the livestream's premature conclusion.

It contains some choice highlights in law enforcement overreach and the assertion of nonexistent authority. The confrontation starts with Officer Letsis claiming Medina's phone probably contains "evidence of a crime," and continues on through to Letsis claiming his seizure and search of the phone is neither a seizure or a search but is very definitely something he has the "legal jurisdiction" to do.

After some back and forth with Medina about his supposed "legal jurisdiction," Letsis decided to seize the phone and view the recording of the arrest. And by "seize," I mean "rip Medina's phone out of her hand."

According to the lawsuit, Medina had offered to provide the video footage to the officer if he gave her a subpoena. After he grabbed the phone, a prompt popped up on the Ustream app to archive the video. Medina, concerned the officer wasn't going to save the video, urged him to archive it. He did, and she then walked him through the process of posting it to a social media site, the suit says.

The officer handed the phone back to Medina and ordered her to show him the video and she complied, since he had posted it for her on social media.

Then he seized it again.

"As soon as Ms. Medina pressed 'play' to start the video, Officer Letsis grabbed the phone from her a second time,'' the suit says. "Officer Letsis did so without warning, and without the consent of Ms. Medina, despite the absence of any probable cause - or any reason at all - to suspect either that Ms. Medina had committed a crime, that the phone contained evidence of a crime, or that the evidence (which he himself had just archived to the Ustream web server) was in any danger of being destroyed.''

The lawsuit goes on to point out Gresham police officials dug their own hole with their post-incident statements, which claimed nothing illegal had occurred and no department policies had been violated.

On approximately February 15, 2013, KGW television published a report on the incident. During the report, a person identified as Gresham police spokesman Claudio Grandjean asserted that Officer Letsis' conduct during the encounter had been legal. Officer Grandjean stated:

“He wasn't doing something illegal. Now, was he inappropriate, or... or or a little rough, or officious or whatever? We can look at that, but that's not nearly as important as was he doing something illegal."

Thus, three days after the incident, the Gresham Police Department took a clear and public position that the actions of Officer Letsis were lawful.

And this, from the police chief, issued nearly a month after the incident:

In the March 5, 2013 memorandum, the Chief stated that "I highly discourage the seizing of property, or the arresting of persons, for simply recording your official actions without your knowledge."

In the March 5, 2013 memorandum, the Chief stated that "I support the reasonable actions of officers to seize cell phones when there is probable cause to believe the recording contains evidence of a crime and there are exigent circumstances to seize the cell phone to prevent the destruction or loss of the evidence," but went on to warn that "[i]f no exigent circumstances that place the property at risk of destruction, you must obtain a search warrant to download the video."

According to the ACLU, these statements indicated officers had not received proper training in respecting the First and Fourth Amendment rights of citizens. That pretty much nailed things down case-wise, as proving "failure to train" is a key element in lawsuits seeking to hold government agencies and employees accountable for their constitutional violations.

Understandably, the three entities being sued decided to settle [PDF] rather than see this debacle rack up even greater monetary losses in front of a jury.

The settlement agreement stipulated that Portland and Gresham must adopt new police policies and training regarding the public’s right to film police activities. The City of Gresham’s new policy under the settlement went into effect in May 2016 and the City of Portland’s new policy went into effect in October 2016. The City of Gresham was also required to pay $85,000 in legal fees to Medina.

The victim of police misconduct only asked for legal fees, which she has donated to the ACLU which represented her pro bono. More important to Medina (and the ACLU) was the establishment of department and city policies recognizing the public's right to hold their public servants accountable through public recordings.

The ACLU notes, however, that the new policies don't appear to have reached every officer covered by them.

Oregon law is now clear that the public has the right to record law enforcement doing their jobs in public, but dos Santos says the ACLU of Oregon still hears from people who have been hassled, detained, or arrested, or who have had their devices confiscated for filming the police, including an incident in Portland last November involving another local activist, Benjamin Kerensa.

“We still see arrests, detentions, and seizures simply for filming the police,” dos Santos said. “With this settlement, we hope that law enforcement across the state will finally respect the public’s right to record. Otherwise, we’ll see them in court again.”

Old habits die hard. And the oldest habits always seem to be the worst ones. The sooner these are broken (or, conversely, the sooner those who can't break them are forced out of jobs), the less expensive it will be for Oregon's taxpayers.

Filed Under: carrie medina, civil liberties, filming police, oregon, phones, taylor letsis, warrant

Prosecutors Have Pulled Data From More Than 100 Phones Seized From Inauguration Day Protesters

from the collect-it-all,-sort-it-out-later dept

More than 100 phones taken from arrested Inauguration Day protesters have had their data exfiltrated, apparently in hopes of pinpointing perpetrators of damage and additional (but unarrested) suspects. As Buzzfeed reports, the unusual investigative step doesn't appear to have been hampered by device encryption.

Prosecutors are extracting data from more than 100 locked cell phones seized during arrests in downtown Washington, DC, on President Trump’s Inauguration Day, according to court papers prosecutors filed on Wednesday.

Prosecutors said they had search warrants to pull data from the phones, which were taken from individuals arrested on Inauguration Day, including some who were not indicted. All of the phones were locked, according to the government, “which requires more time-sensitive efforts to try to obtain the data.” But the filing appeared to indicate that they were successful in accessing information on the phones.

Presumably, prosecutors are looking for communications and photos that will nail down charges against protesters who directly caused $100,000 worth of damage. (Or maybe they're just looking for paystubs?) Another clue can be found in the Motion for Protective Order [PDF] filed by the US prosecutor before turning over the data to defendants' lawyers.

The police were able to arrest approximately 230 of the rioters that day; all of them were charged with violating DC. Code 22-1322 (Rioting or inciting to riot). However, many other rioters evaded arrest by forcibly charging police officers and fleeing.

It looks like the government prosecutor isn't satisfied with the 214 indictments it already has. Cell phones of "unindicted arrestees" have also been searched. Unusually, the data collected isn't being separated. Instead, defense attorneys will have all the access prosecutors have: a full dump of everything and the responsibility to sort out what is or isn't relevant to their case.

According to the filings on Wednesday, the government plans to produce the information it collects from the seized phones to the defendants by way of an electronic database that would be made available to defense counsel. The extracted data includes irrelevant personal information, prosecutors said, so they’re seeking an order from the court that would prohibit defense lawyers from copying or sharing information unless it’s relevant to defend their client.

The cell phone searches sound sketchy, especially when law enforcement has apparently acquired 100 cell phone-sized warrants or, worse, one warrant to search them all. The cell phones searches aren't the government's only bulk operation. Prosecutors are also hoping to prosecute in bulk, dividing the 200+ indictees into four categories for faster processing. One of the defense lawyers involved is fighting this move, pointing out the Constitution takes precedence over the government's convenience.

Christopher Mutimer, a defense lawyer representing one of the defendants, told BuzzFeed News by email on Wednesday that he would oppose efforts by the government to hold joint trials.

“These cases should be tried individually in a manner that protects each individual defendant’s constitutional rights,” Mutimer said. “Not in groupings that make the trials most convenient for the government. Grouping individuals for trial creates a danger of wrongful convictions based on guilt by association.”

Other constitutional inconveniences will have to wait as well. The presiding judge hasn't granted the data dump court order yet but has told arrestees any unconstitutional searches will have to be sorted out during their trials, not prior to prosecution. Expect statements of expertise from law enforcement officers where the word "drug dealer" has been replaced with "protester" to explain the likelihood of finding evidence of drug dealing felony rioting on more than 100 seized and searched cell phones.

Filed Under: arrests, exfiltrated, inauguration, investigation, phones

CIA Leak Shows Mobile Phones Vulnerable, Not Encryption

from the and-cia-isn't-helping dept

As you've probably heard by now, this morning Wikileaks started releasing a new cache of information regarding CIA hacking tools. This is interesting on a variety of levels, but many of the reports focus on the claims that encrypted chat apps like Signal, Whatsapp and Telegram may be compromised. See the top two links in this screenshot:

Wikileaks itself may have contributed to this view with the following paragraph in its release:

These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the "smart" phones that they run on and collecting audio and message traffic before encryption is applied.

But the details don't seem to show that those apps are compromised, so much as that Android and iOS devices are compromised. It's always been true that if someone can get into your phone, the encryption scheme you use doesn't matter, because they can just pull keystrokes or grab data before you encrypt it -- in the same way that someone looking over your shoulder can read your messages as well. That's not a fault of the encryption or the app, but of the environment in which you're using the app itself.

And that should really be the bigger concern here. Over the years, nearly all of the focus on hacking mobile phones has been on the NSA and its capabilities, rather than the CIA. But it's now clear that the CIA has its own operations, akin to the NSA's hacking operations (kinda makes you wonder why we need that overlap). Except that the CIA's hacking team seems almost entirely unconcerned with following the federal government's rules on letting private companies know about vulnerabilities they've discovered.

Remember, the Obama White House put in place what it called a Vulnerabilities Equities Program in which the intelligence community is supposed to default to letting private companies know about vulnerabilities. And, yes, this was always something of a joke as there was a giant loophole involving "except for a clear national security or law enforcement need" that the NSA basically used to withhold vulnerabilities all the time. Still, at least the NSA appeared to get around to revealing some vulnerabilities eventually (probably once they were no longer useful).

Here, however, it looks like the CIA was hoarding some really serious vulnerabilities with wild abandon. In a chart released by Wikileaks you see that the CIA is getting these vulnerabilities from a variety of sources. Some it's finding itself, some it's purchasing, and some are shared via other agencies, such as the NSA or the UK's GCHQ. As Ed Snowden notes, there is now clear evidence (which many suspected, but which had not been proven) that the US government was secretly paying to keep US software unsafe and vulnerable. That's really dangerous. It's putting basically everyone in much more serious danger, just so the CIA, NSA and others can get in when they want to:

This is why the whole conversation about mandating backdoors and "going dark" was so dangerous in the first place. Those were plans to force even more of these vulnerabilities into the wild, just for the very very rare cases where they were needed by law enforcement or intelligence.

At a time when the President is suddenly acting as if he's concerned about domestic surveillance (at least of himself), perhaps now would be a good time to crack down on this kind of stuff. I'm not holding my breath -- but, for now, we're getting a lot more insight into the CIA's electronic surveillance methods, and it sounds like there's more to come.

Filed Under: cia, encryption, hacking, nsa, phones, surveillance, vep, vulnerabilities, vulnerabilities equities program
Companies: wikileaks

Mashable Says You Shouldn't Own What You Buy Because You Might Hurt Yourself

from the that's-just-wrong dept

The news site Mashable has apparently decided that you, the general public, are simply too dumb to actually own the stuff you thought you bought because you might just injure yourself. We've written about so-called "right to repair" laws and why they're so important. There are a variety of issues, but the most basic one here is about property rights. If you buy something, it's supposed to be yours. It doesn't remain the property of whoever first made it. And they shouldn't then be able to deny you the ability to tinker with, modify, or repair what you bought. However, Mashable's Lance Ulanoff (last seen here being completely clueless about the importance of anonymity online because he, personally, never could see a reason why someone might want to speak truth to power without revealing who they are), has decided that because you might be too dumb to properly repair stuff, the entire "right to repair" concept "is a dumb idea."

The article can basically be summed up as "I have a friend, and her iPhone wasn't repaired properly, so no one should be able to repair your iPhone but Apple." Really.

My co-worker, Tracey, held her iPhone like a baby bird with a bent wing. 

I stared at the dark screen. The device was still on, but stuck somewhere between living technology and a dead iPhone. Tracey said that the device made a popping sound and got really hot in one corner while she was making a phone call. Then, her screen cracked, and burnt her ear. She wanted to know what to do. She explained the incident happened shortly after having third-party iPhone screen repair company iCracked replace her shattered iPhone 6 screen. iCracked was ready to let the original technician repair her phone again. I warned her against it. The phone was obviously dangerous—and letting them touch it again probably wouldn’t help. In fact, I thought it might hurt.

Getting past the "using a single anecdote to generalize to absolutely everyone," this still makes no sense. If we want to rule that any kind of repair/modification/tinkering shouldn't be allowed if it might not work right, well... there goes the entire DIY space. This weekend I repaired a broken toilet. It's entirely possible that I could have messed it up (in fact, I did at first, but after a couple of helpful YouTube videos, I got it figured out). Should I not have been allowed to do that? Should I have had to call a plumber who would have charged me $150 just to walk in the door? Lance Ulanoff apparently thinks that's the case. I'm not exactly a handyman, but over the years, I've repaired a ton of stuff in my house from broken dishwashers, computers, garage door openers and more. And sure, if I did it wrong, it could have been dangerous (that garage door opener, in particular, was pretty tricky). But do we really want to live in such a paternalistic society that we shouldn't even be allowed to do that? That seems to be the crux of Ulanoff's article.

Right-to-Repair? What a ridiculous thing to say. No one has the right to repair anything. You might have the skill to repair something (something that iCracked tech might've lacked). And you can hand people all the schematics, instructions, and parts you want and they still won’t be able to replace an iPhone battery or screen.

This is an even sillier argument. His complaint here is with the semantics. It's called a "right to repair," but of course no one's saying everyone will have the ability. The question is whether or not you can even try to repair something that you bought. It's really a question of property rights and whether or not you are breaking the law just trying to tinker with something.

The wonderful world of innovation we live in is built off of people tinkering. The computer industry that makes Mashable possible only exists because a bunch of people were tinkering with different devices and built multiple massive industries out of it. But, Ulanoff is effectively saying that all needs to stop now. Only approved sources can tinker.

Later, Ulanoff tries to clarify that he's fine with people being able to repair stuff... if it has moving parts.

It’s not that I don’t believe in better-built products and repairability. We need tightening against planned obsolescence cycles—TV sets that once lasted 25 years now fail after five. I’m also a tinkerer. I’ve taken apart everything from VCRs to BlackBerry Curve phones and their classic scroll buttons. When I see moving parts, I think: repairability. Today’s phones have almost no moving parts. At least the iPhone 6 had a moveable home button. The iPhone 7 and 7 Plus don’t even have that.

Why the distinction? Who the hell knows? Ulanoff never explains it beyond "when I see moving parts, I think: repairability." Well, good for you Lance. Have a cookie. Not everyone sees the world the way you do. Some people like -- for example -- replacing the significantly weakened battery on their phones so that they can make it last a lot longer. Some people like to replace their cracked screens rather than having to buy a new phone.

But, in the end, Ulanoff is just really concerned that you're just too dumb and you're going to hurt yourself:

I think it’s a fair concern that Right-to-Repair laws could lead to an explosion of Radio Shack-like iPhone and Samsung electronics parts shops. Consumers will wander in with broken iPhone and Samsung Galaxy screens, and walk out with all the parts and tools they need to repair them. And they will fail, miserably.

Plus, what if a consumer's injured during a failed repair attempt? They slice open a finger on the cracked glass, or put it back together incorrectly, so the battery fails (and maybe even explodes). It’s the consumer’s fault, obviously, but they could also try to sue Apple or Samsung.

Try to sue? Sure. Succeed at suing? No. And, really, is that the big concern here? No one should be allowed to tinker with their own devices because they might fuck it up and sue Apple. What?

In the end, once again, this is a question of whether or not people actually own what they buy. Ulanoff, by default, seems to be saying they shouldn't be able to do so. Because they might hurt themselves. Because they're too dumb to know that glass might cut them if not handled properly. But is that really the job of our laws (including copyright law, which is a key component in blocking people from repairing their own phones...) to say "you can't fix or modify something you bought because you're an idiot"? Ulanoff, like in his silly article about not seeing any need for anonymity, apparently doesn't see any need for people to fix their own stuff. Even worse, because he doesn't see such a need for himself, or his friend Tracey, he's decided it's a-ok for the law to clamp down on people who actually are competent and actually are able to modify, tinker or repair products such as phones.

This seems like a very odd way for Mashable to create its opinion pieces. Having some random dude extrapolate his own experiences to apply across everyone. Folks at Mashable responded to lots of people mocking Ulanoff's silly piece by pointing out that it also published a counterpoint. But, as I've noted, this is why I find point/counterpoint arguments so useless. It puts the two arguments on an equal footing and suggests that "welp, you decide." That's silly. Ulanoff's argument makes no sense and is based on nothing more than his own confusion about how the world works. Mashable should feel bad about publishing such an article and pretending it's legit journalism.

Filed Under: devices, freedom to tinker, lance ulanoff, ownership, phones, property rights, right to repair

Cell Phone Hacking Company Hacked; 900 GB Of Logins, Log Files, And Forensic Evidence Taken

from the let-he-who-is-without-security-breaches-throw-the-first-All-Writs-Order dept

Everything is compromised. In the latest case of a hacking company being hacked, Israel's Cellebrite is the latest to have its internal data hauled off by hackers. Joseph Cox of Motherboard was given inside details by the crew that claims to have spirited away login info and other data from the cell phone-cracking company.

Motherboard has obtained 900 GB of data related to Cellebrite, one of the most popular companies in the mobile phone hacking industry. The cache includes customer information, databases, and a vast amount of technical data regarding Cellebrite's products.

Included in the data haul are some other nifty surprises: evidence files from forensic searches of cell phones and logs from Cellebrite devices.

Cellebrite is a major supplier to US law enforcement, as well as to government agencies in countries with sketchier human rights records like Turkey, Russia, and the United Arab Emirates. In many ways, the company is similar to Italy's Hacking Team, which found itself hacked and its emailed dirty laundry aired by enterprising hackers unimpressed by the company's malleable morality.

What's truly interesting about this hack (and those similar to it) is that they go right to the heart of what's wrong with the DOJ's insistence that any "one-time" phone crack -- like the one they pursued in the San Bernardino mass shooting case -- would be safe as houses in the government's hands.

Riana Pfefferkorn -- who helped write an amicus brief on Apple's behalf (along with several other security researchers and professors) -- pointed out on Twitter that Cellebrite's hacking is exactly the sort of risk the government refused to seriously contemplate during its pursuit of an All Writs Order forcing Apple to open up the phone for the FBI.

If such a hack were created by Apple in response to a court order, there's no way for the FBI, Apple, or anyone else to plausibly claim it would be kept out of the hands of malicious actors. Companies in the business of breaking into devices aren't impervious to outside attacks. Neither is the US government, which has proven consistently weak when it comes to securing the massive amount of personally-identifiable information it collects from US citizens.

So far, the collected files haven't been shown to anyone but a few journalists, but Cox points out unauthorized access to Cellebrite isn't exactly a new thing.

Access to Cellebrite's systems has been traded among a select few in IRC chat rooms, according to the hacker.

“To be honest, had it not been for the recent stance taken by Western governments no one would have known but us,” the hacker told Motherboard. The hacker expressed disdain for recent changes in surveillance legislation.

Cellebrite's response to the hack is to claim that the only thing affected was a legacy server for end user licenses. Customers are being encouraged to change their passwords, but that comes a little too late to do much good. That license server may be the only thing breached through unauthorized means, but the log files and obtained evidence the hackers appear to have could easily have been taken out of the front end with compromised credentials.

The underlying fact is this: breaking protections like encryption or purchasing exploits to defeat it is something the FBI and other law enforcement entities will continue to advocate for, even while aware that it's impossible to claim definitively that the tools used won't be hijacked by someone else with more malicious motives. The Shadow Brokers' heist of NSA exploits shows that even if the government takes steps to protect what it has stored on its own servers, it can't prevent a disgruntled analyst from leaving a blackhat toolbag behind for others to find once a surveillance job is finished.

Filed Under: backdoors, encryption, hacking, phones
Companies: cellebrite

Federal Prosecutors Use All Writs Order To Compel Suspect To Unlock Phone With His Fingerprint

from the but-it-still-may-not-have-worked dept

Law enforcement is still trying to break into iPhones and still using the All Writs Act to do so. A sex trafficking prosecution involving the ATF has resulted in a suspect being ordered to cough up his, um, fingerprint, in order to allow investigators to access the contents of his phone. Matt Drange of Forbes has more details [caution: here there be ad-blocker blocking]:

Prosecutors hoped that the search, conducted on an iPhone 5s by special agent Jennifer McCarty of the Federal Bureau of Alcohol, Tobacco, Firearms and Explosives, would help them piece together evidence in an alleged sex trafficking case involving a man named Martavious Keys. Keys had the iPhone with him when he was arrested on May 19, according to recently unsealed court filings. A week later, on May 26, prosecutors asked the judge in the case to force Keys to open the device with his fingerprint, unlocking a potential trove of information including emails, text messages, contacts and photos stored on the device that could be used as evidence.

While courts generally agree that a fingerprint is non-testimonial -- despite its ability to unlock all sorts of testimonial stuff -- there aren't too many courts willing to extend that coverage to passwords. There are exceptions, of course, but items held in someone's mind are given a bit more deference than those at their literal fingertips.

And that's likely why the All Writs-compelled fingerprint access hasn't allowed the ATF inside Keys' phone. The feds can force Keys to place his finger on the iPhone screen all they want, but it likely won't unlock the device. Apple's security requires a passcode as well as a fingerprint if it's been more than 48 hours since the phone was last unlocked. The time elapsed between when the phone was seized and the order obtained for Keys' fingerprint added another layer of security to the phone -- one not so easily defeated with All Writs orders.

Keys is no one's idea of a sympathetic party. He allegedly forced two teen girls, aged 14 and 15, to have sex with men for several hours a day by drugging them into submission. Whether or not his phone contained more evidence is unknown. It's unclear from the recently unsealed documents whether federal investigators found another way into the device after the application of Keys' fingerprint failed to unlock the phone.

And that's sort of a problem. The government is using All Writs orders for a great many things these days, often during sealed cases and with little to no transparency. The fact that Congress apparently authorized this as a fill-in for things warrants couldn't necessarily reach has made the use of All Writs requests both indispensable and easily-abused. The fact that Congress authorized this in 1789 -- with no conceivable idea of the form "papers" would take over the next 200+ years -- usually seems to work in the government's favor.

A bit more transparency would go a long way to assuage concerns about abuse, but overuse/abuse of the 1789 Act is likely the reason there isn't more transparency. If the court decides it's going to compel Keys to turn over his passcode as well (assuming the phone hasn't already been cracked), at least it won't have to toss him in jail if he doesn't. Keys is already behind bars awaiting trial for his sex trafficking indictment. On one hand, that lowers the coercive value of imprisonment. On the other hand -- if he refuses and is hit with a contempt order -- he'll remain in jail indefinitely, even without having been found guilty of anything more than contempt of court.

Filed Under: all writs act, encryption, fingerprint, phones, unlock

Wall Street Journal Reporter Hassled At LA Airport; Successfully Prevents DHS From Searching Her Phones

from the the-government-will-abuse-your-rights-as-far-as-you'll-let-it dept

Welcome to Bordertown, USA. Population: 200 million. Expect occasional temporary population increases from travelers arriving from other countries. Your rights as a US citizen are indeterminate within 100 miles of US borders. They may be respected. They may be ignored. But courts have decided that the "right" to do national security stuff -- as useless as most its efforts are -- trumps the rights of US citizens.

Wall Street Journal reporter Maria Abi-Habib - a US-born citizen traveling into the States with her valid passport -- discovered this at the Los Angeles International Airport. Her Facebook post describes her interaction with DHS agents who suddenly decided they needed to detain her and seize her electronics.

The DHS agent went on to say she was there to help me navigate immigration because I am a journalist with The Wall Street Journal and have traveled to many dangerous places that are on the US' radar for terrorism.

It's generally a good idea to be wary when government employees suddenly offers to "help."

But after pushing me to the front of a very long line at immigration, she then escorted me to the luggage belt, where I collected my suitcase, and then she took me to a special section of LAX airport. Another customs agent joined her at that point and they grilled me for an hour - asking me about the years I lived in the US, when I moved to Beirut and why, who lives at my in-laws' house in LA and numbers for the groom and bride whose wedding I was attending.

Abi-Habib was very cooperative. She answered all of the agent's questions and remained calm despite this interaction being far from ordinary. It didn't matter. The DHS decided to flex its "our border, our rules" muscle.

[T]hen she asked me for my two cellphones. I asked her what she wanted from them.

"We want to collect information" she said, refusing to specify what kind.

"Collect information." That's intrusion and surveillance that serves no discernible purpose. The DHS was obviously hoping Abi-Habib would remain as cooperative as she had during the previous questioning. But Abi-Habib disappointed the DHS agent by suggesting she should talk to the phones' owner about her search plans, rather than just hope a lengthy, suspicionless detention would prompt Abi-Habib to relinquish consent.

"You'll have to call The Wall Street Journal's lawyers, as those phones are the property of WSJ," I told her, calmly.

She accused me of hindering the investigation - a dangerous accusation as at that point, they can use force. I put my hands up and said I'd done nothing but be cooperative, but when it comes to my phones, she would have to call WSJ's lawyers.

She said she had to speak to her supervisor about my lack of cooperation and would return.

Obstruction is an actual crime. This wasn't an empty threat. I mean, it was an empty threat in the way that government officials hand out threats they have no intention of following through with as a means of coercion, but it was not empty as in "without enforceable consequences." It was meant to make Abi-Habib more receptive to granting the DHS permission to search the phones. But behind the threat is an actual criminal statute that could have turned this from a detention to an arrest. And all because the DHS didn't want to obtain consent for its search from the phones' actual owner.

Abi-Habib called the DHS agent's bluff. The DHS relented.

The female officer returned 30 minutes later and said I was free to go.

Abi-Habib's post closes by noting she doesn't fit any terrorism profile and offers security tips for those traveling in and out of the US -- like leaving everything behind that could be searched/seized, or travel with a recently-wiped phone.

The DHS's actions here are disturbing. It suggests agents dig through devices on a regular basis, even when there's a complete lack of suspicion. Laws and court rulings confirm there is a lowered expectation of privacy at US borders, but the agency's refusal to follow through with a search of the devices makes it clear agents are looking to hassle people they think won't fight back -- either during the detention, or after the fact with lawsuits and/or public discussions of their treatment. It's incidents like these that show many public security efforts by government agencies are almost entirely ornamental. It's the illusion of security, rather than an actual protective effort. Border agents dig around in people's stuff just because they can, not because they need to.

Filed Under: cbp, customs and border patrol, journalism, maria abi-habib, phones, searches
Companies: wall street journal

Court Says Cop Calling 911 With Suspect's Phone To Obtain Owner Info Is Not A Search

from the bring-on-the-cellphone-tracking-devices! dept

An interesting ruling out of Georgia states that an unconventional method to determine a cell phone's owner is not a search under the Fourth Amendment. The appeals court decides [PDF] that the information obtained has no expectation of privacy.

Because Hill had no reasonable expectation of privacy in the information at issue – his own name, date of birth, and phone number – we agree with the state there was no search under the Fourth Amendment, and accordingly we reverse.

The background is this: James Brandon Hill exited a taxi cab without paying, leaving his phone behind. The cab driver reported this to the police and an officer dialed 911 to obtain the owner's info. The court doesn't touch the issue of abandonment -- which would likely have made the search legal. But its decision that the method used to obtain this info isn't a search seems to be a bit off.

While the information received may have had no expectation of privacy, an officer accessing a cell phone without a warrant is questionable under the Supreme Court's Riley decision. As noted above, the warrantless search still likely would have survived a motion to suppress as the phone was abandoned in the cab. In fact, Hill does not challenge the seizure of the phone -- only the search.

The Third Party Doctrine is in play here, what with this information being handed over to a service provider in exchange for phone service. The opinion quotes Orin Kerr in support of its Third Party Doctrine assertions.

Consistent with this distinction, we have held in a case involving a landline phone that the Fourth Amendment “protects only the content of a telephone conversation and not the fact that a call was placed or that a particular number was dialed.” Stephenson, supra, 171 Ga. App. at 939 (citation and punctuation omitted). See generally Orin S. Kerr, Applying the Fourth Amendment to the Internet: A General Approach, 62 Stan. L. Rev. 1005, 1019 (II) (A) (2010) (originating telephone number is non-content information analogous to return address on envelope).

But that applies only to phone call routing info, not the user's personal information. It's a good thing this citation isn't a direct comparison because Orin Kerr doesn't agree with the court's decision on the search issue.

Held: Calling 911 from a phone is not a “search” because it only obtains non-content information about the phone that is not protected under Smith v. Maryland.

I don’t think that reasoning works, as it’s mixing up two different questions: (1) whether calling from the phone is a search of the phone, and (2) whether, once the call is placed, receiving the number dialed at 911 is a search of the number. I think calling 911 is a search because of (1), not because of (2). Calling 911 pushes out the number from the phone, and I think that forced revealing of the number should count as a search of the phone.

The decision's implications go much further than this one-off case where an abandoned phone was discovered and "forced" to reveal user info by a law enforcement officer. Think Stingrays. From the opinion:

The fact that it was a law enforcement officer, rather than Hill, who placed a call from the phone does not change our conclusion that the information obtained was not subject to Fourth Amendment protection. Cases from other jurisdictions illustrate this point. In United States v. Skinner, 690 F3d 772, 777-778 (II) (A) (6th Cir. 2012), for example, the United States Court of Appeals for the Sixth Circuit held that law enforcement agents could take action to cause a cellular phone to emit information from which they could track it without running afoul of the Fourth Amendment, because the defendant did not have a reasonable expectation of privacy in the location data emitted from the phone.

If this isn't a search, then the use of an IMSI catcher isn't a search, even though it involves the manipulation of a person's phone by law enforcement to obtain information otherwise not immediately obtainable.

As for the Riley decision, the court decides use of the phone is not the same as accessing the phone's contents.

Here, in contrast to Riley, the officer did not access any files on Hill’s phone, which was protected by a passcode. He “did not attempt to retrieve any information from within the phone,” United States v. Lawing, 703 F3d 229, 238 (II) (A) (ii) (4th Cir. 2012), but instead used the phone in a manner that caused it to send Hill’s telephone number to a third party, the 911 dispatcher. We do not construe Riley to prohibit an officer in lawful possession of a cellular phone from placing a call on that phone in an attempt to obtain identifying information about its owner. Moreover, we do not construe Riley to recognize a legitimate expectation of privacy in identifying, non-content information such as the person’s own phone number, address, birthdate, simply because that information was associated with a cellular phone account rather than a landline phone account or a piece of physical mail.

While historical cell site location info is generally considered to be free of expectations of privacy under the Third Party Doctrine, real-time access of this same information is still under discussion in several courts. Making the argument that law enforcement manipulation of a person's cell phone to extract information not otherwise immediately obtainable suggests that this particular court would look favorably on the use of Stingray devices to locate cell phones. After all, the phone's location is a third-party record, even though it's not a third-party record that isn't normally obtainable as it's being generated.

It's a limited ruling from a state appeals court, but it still shows advances in surveillance tech will be granted a lot of leeway by judges because of a decision nearly four decades old at this point (Smith v. Maryland, 1979). Had the court come to the conclusion it was a search, it wouldn't have saved Hill (because he abandoned his phone), but it at least would have recognized it's one thing to obtain third-party records from a third party. It's quite another when the government uses a closed loop to obtain the same info.

Filed Under: 4th amendment, calling 911, georgia, phones, search

FBI Claims It Has No Record Of Why It Deleted Its Recommendation To Encrypt Phones

from the maybe-it-was-encrypted dept

A couple of years ago, I wrote about how -- just as the FBI was whining about encryption and "going dark" -- it was, at the same time, urging people to encrypt their mobile phones to protect against crime: Then, last year, I noticed that the page had been deleted. Seemed curious, so I sent in a Freedom of Information Act (FOIA) to the FBI to better understand why that page had magically been deleted, just at the time it seemed to contradict the FBI Director's statements about encryption.

It, of course, took much longer than the legally mandated 20-day response time, but the FBI has finally "responded" to tell me that it can't find anything. So sorry, too bad. If you can't read that, it says:

Based on the information you provided, we conducted a search of the locations or entities where records responsive to your request would reasonably be found. We were unable to locate records responsive to your request. If you have additional information that may assist in locating records concerning the subject of your request, please provide us the details and we will conduct an additional search.

It is, of course, entirely possible that my request was not clear enough -- though I specifically pointed them to where the URL used to be and what was on it. So I'm not entirely sure what other information to provide in response. And that's part of the problem with the FOIA process. It's something of a guessing game, where if you don't guess exactly the proper way to phrase what you want, they'll just come back with a no responsive documents response. Of course, perhaps they just encrypted the information on an iPhone and they won't be able to get it for me unless they win their fight against Apple... right?

Help us keep covering stories like these!

Filed Under: doj, encryption, fbi, foia, mobile encryption, phones