DOJ Misled Judges For Years About How It Was Using Stingray Devices To Spy On People

from the well-of-course dept

How many times does it need to be repeated? If you give law enforcement the ability to spy on people -- even with limits -- law enforcement will always blow through those limits and abuse its powers. It happens over and over and over again. And that becomes doubly true when law enforcement has worked out ways to avoid oversight. Back in 2011, the WSJ broke a huge story about the frequent use by government officials of a technique for mobile device surveillance generically called "stingray" devices (technically, there are a few products used for this, only some of which are actually called Stingrays, but the name is now used to refer to all of them). The device works by pretending to be a mobile phone tower, so devices can connect to it, and law enforcement gets all your data. It's basically a cellular man-in-the-middle attack, with law enforcement being that man in the middle. Yay.

The technology has been a key component in a case involving Daniel Rigmaiden, which we wrote about last year. Rigmaiden was taken into custody (on a fraud charge) and, representing himself in court, he has sought more info on how he was tracked down -- leading to some reluctant disclosure about law enforcement using Stingray devices on questionable authority to find him. In that case, we noted that law enforcement claimed it had a court order to use the technology, but the judge was confused, asking where were the warrants for the use of the device. The judge asked how it was possible that a court order or warrant was issued without the judge ever being told about the technology used in surveillance and was told, simply, "it was a standard practice."

Indeed, that appears to be the case. The ACLU filed a bunch of FOIA (Freedom of Information Act) requests to dig into this and newly released documents show that, indeed, it was apparently standard practice by the DOJ to be "less than explicit" and less than "forthright" with judges in seeking warrants and court orders to make use of this technology. Here's an email that was revealed:

As some of you may be aware, our office has been working closely with the magistrate judges in an effort to address their collective concerns regarding whether a pen register is sufficient to authorize the use of law enforcement's WIT technology (a box that simulates a cell tower and can be placed inside a van to help pinpoint an individual's location with some specificity) to locate an individual. It has recently come to my attention that many agents are still using WIT technology in the field although the pen register application does not make that explicit.

While we continue work on a long term fix for this problem, it is important that we are consistent and forthright in our pen register requests to the magistrates…

Basically, that's the DOJ admitting that it has not been forthright or explicit in letting judges know that it is going to use this extremely intrusive form of surveillance in seeking approvals. And the courts have been concerned about this. As the ACLU notes, this email was written three years after the Rigmaiden situation happened -- suggesting that the DOJ has been getting away with this sort of thing for many years, without anyone digging in. The ACLU is now arguing that this should be a reason to suppress the evidence obtained via these devices, and will ask the court to "send a clear message" that it cannot hide the truth from federal judges in seeking rubber stamps to violate the privacy of the public.

Filed Under: 4th amendment, doj, man in the middle, privacy, stingray, surveillance, warrants

Patrick Leahy Introduces Legislation (Yet Again) To Require Government Warrants To Get Your Electronic Info

from the dc-just-keeps-doing-remakes dept

It's been quite a day in terms of news out of DC. We've been talking about copyright/first sale, cybersecurity bills, the CFAA... and now Senator Patrick Leahy, for what feels like the 2,394th time, has introduced a plan to reform ECPA. Like the CFAA, ECPA is an extremely troubling and outdated piece of legislation where Congress tried to deal with "those computer things" back in the 1980s in a manner that just doesn't make any sense today. Mainly it has opened up massive loopholes for the US government to access your data with little to no oversight (for example, the law considers messages on a server for over 180 days to be "abandoned" and thus fair game for law enforcement, as it never considered the idea of cloud storage). Senator Leahy would like to update the law to protect our privacy, such that law enforcement would actually be required to get a warrant.

If all of this sounds familiar, you wouldn't be wrong. We've been discussing it forever. Leahy keeps introducing bills and they never seem to turn into law. Law enforcement has been his main antagonist on this, though the DOJ (somewhat surprisingly) appeared to concede today that ECPA needs significant reform, even calling out the 180 day issue explicitly in testimony before the Judiciary Committee:

Many have noted—and we agree—that some of the lines drawn by the SCA that may have made sense in the past have failed to keep up with the development of technology, and the ways in which individuals and companies use, and increasingly rely on, electronic and stored communications. We agree, for example, that there is no principled basis to treat email less than 180 days old differently than email more than 180 days old. Similarly, it makes sense that the statute not accord lesser protection to opened emails than it gives to emails that are unopened.

That said, the DOJ is likely to push back on significant parts of any ECPA reform effort, to make sure it still has the ability to trawl through as much data as possible. Much of the testimony seems to warn of a parade of horribles that could occur if (*gasp*!) it has to get warrants for everything.

Filed Under: ecpa, ecpa reform, patrick leahy, privacy, reform, warrants

The FISA Amendments Act Is Clearly Unconstitutional; And Congress Doesn't Care

from the but-but-terrorism dept

We've been discussing the now annual rush to re-approve the FISA Amendments Act, despite the fact that the original bill was on shaky constitutional ground, and it's been made much (much, much) worse due to a secret interpretation of what the law means (a secret interpretation that many in Congress apparently have no interest in finding out about). Andrew Napolitano, a former judge, has penned an interesting column laying out many of the reasons why the whole thing is completely unconstitutional. First, he notes that the establishment of FISA itself is likely a violation of the 4th Amendment:

The constitutional standard for all search warrants is probable cause of crime. FISA, however, established a new, different and lesser standard -- thus unconstitutional on its face since Congress is bound by, and cannot change, the Constitution -- of probable cause of status. The status was that of an agent of a foreign power. So, under FISA, the feds needed to demonstrate to a secret court only that a non-American physically present in the U.S., perhaps under the guise of a student, diplomat or embassy janitor, was really an agent of a foreign power, and the demonstration of that agency alone was sufficient to authorize a search warrant to listen to the agent's telephone calls or read his mail.

Already troubling enough, but, as Napolitano notes, things weren't just left there. They've continued to stretch and change the conditions, taking it further and further into unconstitutional realms:

Over time, the requirement of status as a foreign agent was modified to status as a foreign person. This, of course, was an even lesser standard and one rarely rejected by the FISA court. In fact, that court has rarely rejected anything, having granted search warrants in well over 97 percent of applications. This is hardly harmless, as foreign persons in the U.S. are frequently talking to Americans in the U.S. Thus, not only did FISA violate the privacy rights of foreigners (the Fourth Amendment protects "people," not just Americans); it violated the rights of those with whom they were communicating, American or non-American.

It gets worse. The Patriot Act, which was enacted in 2001 and permits federal agents to write their own search warrants in violation of the Fourth Amendment, actually amended FISA so as to do away with the FISA-issued search warrant requirement when the foreign person is outside the U.S. This means that if you email or call your cousin in Europe or a business colleague in Asia, the feds are reading or listening, without a warrant, without suspicion, without records and without evidence of anything unlawful.

It's just those Patriot Act amendments (the FISA Amendments Act) that is being debated right now. And given some of the questions being asked by politicians who understand the "secret interpretation" of the FISA Amendments Act, it appears that it actually gives law enforcement the ability to go even further. So it's not even just about emailing or calling your cousin in Europe, but as long as law enforcement (a) claims that it's related to a terrorism investigation and (b) they have no specific knowledge at the time of acquisition only that the communication is domestic -- then they can collect just about anything. So, under that interpretation, it appears that the NSA can just collect well, almost anything, by saying that it's all for the sake of a permanent and all encompassing terrorism investigation, and since they're just collecting absolutely everything, they have no specific knowledge at the time of acquisition that the communication is domestic.

Considering that Napolitano's argument starts from the idea that FISA itself is unconstitutional, looking at where we are now from where we started, we're no longer just in "unconstitutional" mode, in which we've tip toed over the boundary. We're now in a full on, 100% "let's mock the Constitution" mode. And, Napolitano, like many others, wonders why almost no one in Congress is willing to point this out:

Moreover, everyone in Congress has taken an oath to uphold the Constitution, which could not be more clear: "The right of the people to be secure in their persons, houses, papers, and effects..." shall not be violated, except via a warrant issued by a neutral judge upon the judge finding probable cause of crime. If we let Congress, which is a creature of the Constitution, change the Constitution, then no one's liberty or property is safe, and freedom is dependent upon the political needs of those in power.

The President and the leadership of both political parties in both houses of Congress have abandoned their oaths to uphold the Constitution. They have claimed that foreigners and their American communicants are committed to destroying the country and only the invasion of everyone's right to privacy will keep us safe. They are violating the privacy of us all to find the communications of a few. Who will keep us safe from them?

It's no secret that politicians use fear to increase their own power and to cut away at civil liberties. We have plenty of history that demonstrates that. It's just a real shame that so few people seem willing to speak out about this -- or that so few people even seem to care that the government has done this.

Filed Under: 4th amendment, congress, constitution, fisa, fisa amendments act, privacy, warrants

Senate Committee Approves ECPA Reform That Requires Warrants; But Will It Ever Become Law?

from the doubtful dept

As we had hoped earlier this week, the Senate Judiciary Committee did, in fact, approve Senator Patrick Leahy's attempt at ECPA reform, which would require law enforcement to do something crazy like "get a warrant" before sifting through your email. The bill was approved despite law enforcement types freaking out that they might actually have to ask a court for permission. Senator Chuck Grassley, as expected, introduced an amendment that would have greatly weakened the warrant requirement for various federal agencies, but it was thankfully voted down.

Of course, at this point, the victory is largely symbolic, as it's happening in a lameduck Congress. The bill still needs to pass the full Senate and have a comparable House version pass as well. In other words: nothing is happening until next year when this whole process may need to repeat. And given some of the quotes from Grassley and law enforcement, there will be yet another effort to strip some of these warrant requirements. Still, it's nice to see that there's at least some recognition in Congress that electronic privacy laws are woefully out of date, and leave private information, such as emails, way too open to law enforcement snooping.

Filed Under: chuck grassley, ecpa, ecpa reform, law enforcement, patrick leahy, privacy, warrants

Megaupload Helped DOJ In NinjaVideo Prosecution; And DOJ Uses That Against Megaupload

from the outrageous dept

On Friday, we wrote about the unsealed seizure warrants against Megaupload, and noted that they showed how Megaupload had assisted in a criminal investigation, in which they were told not to interfere with the files, but then those very files were used as evidence against Megaupload itself. It's now come out that this was part of the case against NinjaVideo, which we wrote about a few times. Apparently, NinjaVideo used Megaupload to store some of its files, and the DOJ sent a warrant to Megaupload, which they complied with:

“Megaupload complied with the warrant and cooperated with the government’s request,” Rothken said. He said Megaupload had gotten “a number of such warrant and subpoena type requests a year and still have an expectation that as classic ‘online service providers’ they are immune from liability for the acts of users who are the target of such warrants and subpoenas.”

But, as the unsealed warrants show, the DOJ later used those same files as evidence that Megaupload "knew" there were infringing files on its servers, leaving out the bit about how they had requested Megaupload not delete them. That seems like yet more fairly egregious behavior by the DOJ in a case that's chock full of it. Once again, I'm left wondering how the DOJ could do so many questionable things in their pursuit of Dotcom. It really looks like they bought Hollywood's mythic story about Dotcom hook, line and sinker, and believed that once they took him down, the case would simply fall into place.

Rothken calls the government’s argument “outrageous.” Given the NinjaVideo search warrant, and the government’s specific request for secrecy and to retain the files, Megaupload might have been accused of evidence-spoliation if it had taken the movies down, says Rothken.

“If anything, such a cooperation request by the government bolstered Megaupload’s view that as a cloud storage intermediary it was operating lawfully even if some users may have been misbehaving,” Rothken said.

Back when the Megaupload indictment and arrests first came down, I had a conversation with a couple of lawyers who insisted that, given the claims in the indictment, the DOJ must have had really strong evidence against Megaupload. But pretty much every discovery since then has suggested that they only had strong evidence in their minds...

Filed Under: copyright, criminal investigation, doj, warrants
Companies: megaupload

If There Needs To Be An Investigation, It Should Be About Why The FBI Was Reading Certain Emails

from the friendly-fire dept

While some have noted the irony of General Petreaus being taken down due to online surveillance methods that he should have been aware of, the case is bringing growing attention to an issue many of us have been discussing for a while: how easy it is for law enforcement to snoop through your email. We raised the question already, but as more info comes out, the whole thing is looking that much more questionable.

Julian Sanchez keeps trying to find out exactly what legal process the FBI used to go through a variety of email accounts based on an apparently non-criminal cyberstalking claim (which was apparently brought to the FBI by a non-cyber-focused agent who had seemed to have a crush on the "victim"of the cyberstalking), and notes that there are big questions about what process was used to go through these emails and how much oversight was involved:

To Julian Sanchez, a research fellow at the Cato Institute, the real scandal over the Petraeus affair is not the extramarital sex, but the invasion of privacy.

"Law enforcement and certainly intelligence agencies have an incredible amount of ability to gather huge volumes of detailed information about people's most intimate online communications, a lot of it without requiring a full-blown warrant, a lot of it without requiring even any kind of judicial approval," Sanchez said.

Meanwhile, Chris Soghoian, working for the ACLU, highlights some of what's been revealed about the snooping. For example, FBI agents tracked down Patricia Broadwell as the email sender, even though she was using throwaway accounts, because webmail providers record the IP address from whence someone logs in -- and Broadwell didn't conceal that info. Apparently, the IP addresses were a series of hotels, and cross-checking with guest lists, it didn't take long to narrow down the only real suspect. Oh, and none of that info required judicial oversight for the FBI to get:

The guest lists from hotels, IP login records, as well as the creative request to email providers for “information about other accounts that have logged in from this IP address” are all forms of data that the government can obtain with a subpoena. There is no independent review, no check against abuse, and further, the target of the subpoena will often never learn that the government obtained data (unless charges are filed, or, as in this particular case, government officials eagerly leak details of the investigation to the press). Unfortunately, our existing surveillance laws really only protect the “what” being communicated; the government’s powers to determine “who” communicated remain largely unchecked.

He also delves into the method by which Petreaus and Broadwell communicated -- by sharing an account and communicating via "drafts" that were saved. For the head of the CIA you'd think he'd use a method that wasn't long known to be just as (if not more) insecure than regular email. Soghoian tears apart this supposedly "secret" method of communicating:

For more than a decade, a persistent myth in Washington DC, fueled by several counterterrorism experts, has been that it is possible to hide a communications trail by sharing an email inbox, and instead saving emails in a “draft” folder. This technique has been used by Khaled Sheikh Mohammed, Richard Reid (the shoe bomber), the 2004 Madrid train bombers, terrorists in Germany, as well as some domestic “eco-terrorists.” This technique has appeared in federal court documents as early as 2003, and was described in a law journal article written by a DOJ official in 2004. It is hardly a state secret.

Apparently, this method was also used by General Petraeus. According to the Associated Press, “[r]ather than transmitting emails to the other's inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder or in an electronic ‘dropbox,’ the official said. Then the other person could log onto the same account and read the draft emails there. This avoids creating an email trail that is easier to trace.”

The problem is, like so many other digital security methods employed by terrorists, it doesn’t work. Emails saved in a draft folder are stored just like emails in any other folder in a cloud service, and further, the providers can be compelled, prospectively, to save copies of everything (so that deleting the messages after reading them won’t actually stop investigators from getting a copy).

Ironically enough, by storing emails in a draft folder, rather than an inbox, individuals may be making it even easier for the government to intercept their communications. This is because the Department of Justice has argued that emails in the “draft” or “sent mail” folder are not in “electronic storage” (as defined by the Stored Communications Act), and thus not deserving of warrant protection. Instead, the government has argued it should be able to get such messages with a mere subpoena.

Got all that? It's even more info that the FBI may have been able to obtain without ever having to get approval from a judge. That's not to say they didn't necessarily go before a judge to get a warrant or similar tool for surveillance, but it does highlight just how much info the FBI can obtain without any real oversight, and how it's entirely possible for it to be abused -- taking a very limited situation (non-criminal online harassment) and turning it into something massive.

In fact, as the EFF's Trevor Timm notes, we should be investigating the FBI over why it was snooping through people's emails and how frequently it does this. He notes, as others have, that nothing about the origination of this case should have resulted in FBI involvement, let alone reading people's emails. Remember, early on, no one knew this had anything to do with General Petreaus or any other high ranking official:

The spark that set events in motion was a handful of allegedly harassing emails sent anonymously to Kelley, a friend of Petraeus's, which she brought to a friend at the FBI. Yet it's unclear why an investigation was ever opened, given that everything publicly known about the emails suggests they weren't illegal.

As the Daily Beast reported, they said things like "Who do you think you are? ... You parade around the base ... You need to take it down a notch." The story noted, "when the FBI friend showed the emails to the cyber squad in the Tampa field office, her fellow agents noted that the absence of any overt threats."

It seems the deciding factor in opening the investigation was not the emails' content, but the fact that the FBI agent was friendly with Kelley. (Even more disturbing, the same FBI agent has now been accused of becoming "obsessed" with the Tampa socialite, sent shirtless pictures to her, and has been removed from the case.)

Basically, it sounds like the FBI had very questionable reasons for digging all that deep into this case at all. Michael Davis, at the Daily Beast, notes that the emails were typical "cat-fight stuff," with no indication of illegal activity:

When the FBI friend showed the emails to the cyber squad in the Tampa field office, her fellow agents noted that the absence of any overt threats.

“No, ‘I’ll kill you’ or ‘I'll burn your house down,’” the source says. “It doesn’t seem really that bad.”

The squad was not even sure the case was worth pursuing, the source says.

“What does this mean? There’s no threat there. This is against the law?” the agents asked themselves by the source’s account.

At most the messages were harassing. The cyber squad had to consult the statute books in its effort to determine whether there was adequate legal cause to open a case.

“It was a close call,” the source says.

So while there's all sorts of talk of investigations into who should have known the details of what was going on at what time, no one seems to be questioning why a simple "cat fight" resulted in the FBI digging in and reading people's emails. Yet, that seems like something we should all be quite worried about.

Indeed, if there's any "benefit" to come out of this, perhaps it's that more and more people are hopefully realizing just how easy it is for the FBI to spy on people electronically.

Filed Under: david petreaus, email snooping, fbi, oversight, privacy, subpoenas, warrants

How Much Did The FBI Snoop On Email Messages To Uncover The Petreaus Situation?

from the all-for-what? dept

As you're probably aware since it's "the big story" right now, General David Petreaus stepped down last week after an FBI investigation turned up an affair he'd been having. It seems that every few hours more news "breaks" on the story, and it keeps getting more involved, with a growing number of players (and with each new revelation the story gets more and more bizarre). However, some have started wondering how and why the FBI was snooping on various emails. The original story was that it came about after Petreaus' mistress allegedly sent threatening (anonymous) emails to another woman, who reported them to the FBI. From that came a wider investigation, which supposedly may involve another General and a variety of other players. But some are realizing that this seems to show how the FBI has pretty free rein in terms of snooping on email accounts hosted online:

Under the 1986 Electronic Communications Privacy Act, federal authorities need only a subpoena approved by a federal prosecutor — not a judge — to obtain electronic messages that are six months old or older. To get more recent communications, a warrant from a judge is required. This is a higher standard that requires proof of probable cause that a crime is being committed.

But even that isn't entirely clear. Folks like Julian Sanchez have been puzzling through the timeline of events and wondering how a simple investigation into a small number of "rude" (but not illegal) emails then uncovered thousands of questionable emails involving a different general as alleged in the news that broke last night. It feels like the FBI may have taken a simple report of misconduct (which may have been driven by another love triangle issue involving an FBI agent who seemed to take the whole thing a lot more personally than makes sense) and turned it into a massive fishing expedition.

Given how fast new parts of this story keep breaking, I'm sure there are still a number of other dominoes to fall, but hopefully this actually gets people to pay attention to just how easy it is for law enforcement to snoop on people's emails these days based on next to nothing.

Filed Under: david petreaus, email, expa, fbi, snooping, warrants

Law Enforcement Officials Freak Out About Possibility Of Having To Get Warrants To Read Your Email

from the bill-delayed dept

We recently noted that Senator Leahy had attached his mostly good ECPA (Electronic Communications Privacy Act) reform bill to another bill reforming the VPPA (Video Privacy Protection Act). The ECPA reform would update a decades-old law that law enforcement has interpreted to more or less mean they don't need a warrant to read your online email. Leahy's update would require a warrant. This is a good and important reform that should be supported. But, of course, law enforcement freaked out and it appears that Leahy has backed down, delaying hearings on the bill for now (funny how he really wanted to push through PIPA despite massive public protests, but a few law enforcement people get upset about respecting the 4th Amendment and things get delayed). From Declan McCullagh's coverage:

The delay comes two days after a phalanx of law enforcement organizations objected to the legislation, asking Leahy to "reconsider acting" on it "until a more comprehensive review of its impact on law enforcement investigations is conducted." The groups included the National District Attorneys' Association and the National Sheriffs' Association.

[....] A person participating in Capitol Hill meetings on this topic told CNET that Justice Department officials have been expressing their displeasure about requiring search warrants. The department is on record as opposing such a requirement: James Baker, the associate deputy attorney general, has publicly warned that requiring a warrant to obtain stored e-mail could have an "adverse impact" on criminal investigations.

Of course it would have "adverse impact" on criminal investigations. So do lots of things -- but those are the rules law enforcement plays by in a free society. It's not built to make law enforcement's life easy.

Either way, it appears that this bit of ECPA reform will get pushed off once again. Hopefully, when it comes back, it won't be watered down.

For what it's worth, both the EFF and the ACLU -- who strongly support ECPA reform similar to what Leahy has been proposing -- have also not been that happy with how Leahy introduced this bill, because they both oppose the changes to the VPPA, which they're afraid will weaken privacy for people. This is a (somewhat rare, but not unprecedented) situation where I disagree with both of those organizations. The VPPA was a specific and broad carve-out to deal with a single situation (bork bork bork). I think it's reasonable to update it to allow for things like letting people choose to let Netflix and social networks share info on what movies they've watched -- just like the can choose to show what music they listen to. I don't necessarily believe that it makes sense to link the VPPA to ECPA reform, but I don't think that passing the VPPA reform is so problematic that it should stop ECPA reform. Of course, if law enforcement has its way (and so far, that seems to be the case), ECPA reform might never happen. Is it really worth worrying about how you can choose to share your Netflix movies on Facebook while the Justice Department feels it can snoop broadly through your Gmail?

Filed Under: 4th amendment, ecpa, patrick leahy, privacy, vppa, warrants
Companies: netflix

LAPD Joins Feds In Skirting Fourth Amendment With Cell Phone Tracking Devices

from the rules-are-for-the-people-on-the-other-side-of-the-thin-blue-line dept

About this time last year, details emerged on a new cell phone tracking device being used by the FBI to triangulate suspects' locations via their cell phone signals. One of these, the StingRay, mimics mobile phone towers, allowing the feds to triangulate someone's position using signal strength. It had been used successfully to bring Daniel Rigmaiden, wanted for fraud, into custody.

Rigmaiden (who is representing himself) was curious as to how he was located and a question on due process was posed by the judge:

In a February hearing, according to a transcript, Judge Campbell asked the prosecutor, "Were there warrants obtained in connection with the use of this device?"

The prosecutor, Frederick A. Battista, said the government obtained a "court order that satisfied [the] language" in the federal law on warrants. The judge then asked how an order or warrant could have been obtained without telling the judge what technology was being used. Mr. Battista said: "It was a standard practice, your honor."

Judge Campbell responded that it "can be litigated whether those orders were appropriate."

The FBI believes it can (and apparently, still does) track people using these devices without securing a warrant. Most discussion of the devices has been shut down by stating that revealing too much information would "harm law enforcement efforts by compromising future use of the equipment." The feds also believe that since the device only detects location, rather than eavesdropping, it's all cool, 4th Amendment rights or no.

So, while the jury is almost literally still out on the constitutionality of these devices, local law enforcement members have been availing themselves of them. LA Weekly, using recently obtained FOIA documents, discovered that the Los Angeles Police Department (along with police in Miami, Ft. Worth and Gilbert, AZ) has obtained and deployed the questionable StingRay. Not that the LAPD has much to say about its use, however:

LAPD refuses to discuss how it uses the powerful tool, perhaps copying the FBI's playbook, which argued in the Rigmaiden case that revealing too many details would cause serious harm to future investigations.

The department, through a spokesperson, refused to comment on the device, despite repeated requests from the Weekly. Through the department's Discovery Unit, which handles requests from the public and media under the California Public Records Act, LAPD also declined to reveal any information on how the devices are used.

LAPD even refuses to say whether its detectives are required by police chief Charlie Beckand the Los Angeles Police Commission — all of whom are appointed by Mayor Antonio Villaraigosa — to obtain a search warrant before the StingRay is deployed against unsuspecting L.A. residents' cellphones.

Chances are the LAPD is deploying the devices without obtaining warrants, what with the FBI having set the precedent. With no court decision having been handed down yet dealing specifically with cell phone location trackers, law enforcement officers are pretty much free to explore the limits of this gray area. Refusing to discuss any details is par for the course for most enforcement agencies when asked about questionable means and technology, most of whom cite "serious harm" or "compromised investigations" as the reason for their obfuscation.

Speaking of dubious catch-all phrases, guess which one of the all-time "greats" was used to justify the purchase of these cell phone tracking systems:

Documents obtained from the Inspector General's office of the Department of Homeland Security reveal that LAPD bought two so-called "IMSI catchers" around 2006. At the time, LAPD had "recently purchased a cellphone tracking system (CPTS) for regional, terrorist-related investigations." The records mention StingRay and KingFish, brand names for IMSI devices made by Florida's Harris Corp.

Oh, yes. "Terrorism." Citing this vague threat in the law enforcement arena tends to open wallets and close minds with incredible efficiency. But the LAPD's acquisition of the cell phone trackers went one step further, and completely cut out any last vestige of public accountability.

Separate documents show that, in April 2010, the Los Angeles City Council approved the purchase of $347,050 in additional "StingRay II" equipment — and paid for it with outside funds from the Los Angeles Police Foundation, a nonprofit group that supports police functions, over which the city has no control.

The LAPD's refusal to discuss any aspect of these devices is "inconsistent with the democratic process," according to Peter Bibring of the ACLU, which makes sense, considering the use of the device itself seems to be "inconsistent with the democratic process." Seeing as the devices mimic cell phone towers, it would seem that the public might be very interested to know that the strongest signal in their neighborhood might actually be the LAPD doing a little tracking without a warrant or oversight.

Mobile devices connect to the wider network by using the antennae closest to them at the time. But when LAPD fires up a StingRay, it's often the most powerful signal in the area. Instantly, the department's spy equipment becomes the go-to "tower" for every cellphone and mobile device nearby — not just the phone carried by the suspect they're tracking.

"If the government shows up in your neighborhood, essentially every phone in the neighborhood is going to check in with the government," Soghoian warns. "It's almost like Marco Polo — the government tower says 'Marco,' and every cellphone in the area says 'Polo.' "

Maybe the feds and other smaller law enforcement agencies could just work to cut out the cell phone provider middleman and simply convert existing towers to "always-on" tracking devices. With enough subsidization, even those with the lowest income could avail themselves of 3G/4G service (depending on how many G-men are staffing the Flowers By Irene van), and the California Department of Corrections could up the ante by promising "More Bars in More Places."

Until a decision is handed down on the warrant question, it's safe to assume that law enforcement will be deploying these cell phone trackers as often as possible, using the "Beating Up on Crime/Terrorism" ends to justify the 4th Amendment-skirting means.

Filed Under: fourth amendment, lapd, mobile phone tracking, privacy, stingray, warrants

Senator Leahy Brings Back Bill That Would Require Warrants When Gov't Snoops Through Servers For Your Info

from the ecpa-reform dept

The Electronic Communications Privacy Act (ECPA) is ridiculously outdated. It was passed in 1986, and to this day provides the (incredibly inconsistent and difficult to apply) rules for what sort of privacy electronic communications have, even though the technology has changed drastically. This has created some wacky consequences, including that (for example) emails have different privacy protections when an email is being written compared to when it's being sent compared to when it's been received compared to when it's been read compared to when it's been archived. As an example, since most messages did not stay on servers for very long (they were downloaded and deleted), the law decided that messages stored on a server for more than 180 days were considered "abandoned" and subject to even lower standards of privacy protections. Think about that the next time you open your Gmail account... ECPA has lots of problems, but the basics are this: it certainly didn't anticipate an era where most of the things we do were in the so-called "cloud," and it takes almost no account of the expectation of privacy.

Last year, Senator Pat Leahy introduced an ECPA reform bill that was mostly good. It basically said that if the government wants to get access to your data on a server, it first needs to obtain a warrant -- something that is sorely missing today. There were some loopholes that concerned us, but for the most part, it was a very big improvement. And it went nowhere. Now, many folks around here will remember Senator Leahy for being the driving force in the Senate behind PIPA -- and you may be quick to want to dismiss his actions here. But just because he's (strongly) supported that bad bill, it doesn't mean that everything he introduces has been similarly problematic.

Leahy is trying again to move forward with his ECPA reform plan, this time attaching it to an update of the Video Privacy Protection Act (VPPA). We've discussed the VPPA before. The short version is that it was a special law that bars the release of video rental info, passed in response to Supreme Court nominee Robert Bork having his video rental history leaked. But, of course, in this modern age where people automatically stream their music playlists or book purchases to Facebook... Netflix is left out in the cold, because the VPPA doesn't allow them to do the very same thing. So, there's an update to the VPPA making the rounds that basically changes the law to let you tell the world what you streamed from Netflix last night (if you so choose to share that kind of info).

That bill has a chance to actually go somewhere, and it looks like Leahy sees it as another chance to see if he can get his ECPA reform package through the Senate. While it's no secret that I've had my differences with various Leahy proposals in the past, this is a reform that is badly needed to protect our privacy from government intrusion. Requiring a warrant to access your info in the cloud is a common sense move that's long overdue.

Filed Under: cloud computing, ecpa, patrick leahy, privacy, warrants