Judge Allows Fourth Amendment Challenge Of Warrantless Device Searches At The Border To Continue

from the uphill-battling dept

A federal judge has allowed the ACLU, EFF, and the several plaintiffs they represent to continue their Fourth Amendment lawsuit against DHS, ICE, and CBP. The plaintiffs are challenging the Constitutionality of border device searches -- something that has skyrocketed in recent years. As it stands now, these agencies believe nothing stronger than reasonable suspicion is needed to perform highly-intrusive searches. In many cases, not even suspicion is needed, thanks to the "border search" exception to the Fourth Amendment courts have carved out for the government.

Policies for agencies performing border device searches are pretty much identical. All allow searches and seizures of devices without individualized suspicion. This warrantless, suspicionless search may also result in the device being confiscated for weeks or months while a forensic search is undertaken -- again, supposedly without violating travelers' rights. CBP's policy was altered this year, requiring forensic searches and the mirroring of devices to at least reach the level of reasonable suspicion. Better than ICE's policy, but still nothing approaching a warrant.

The government sought to have the lawsuit dismissed, claiming the plaintiffs had no standing to assert violations, much less seek injunctive relief on the theory they would likely be subjected to intrusive device searches the next time they traveled.

The court disagrees with all the government's arguments. The government claimed the number of device searches -- although steadily increasing -- is still a small percentage of the overall whole. The court points out it doesn't really matter what the percentage is. It's whether or not CBP and ICE perform these searches routinely. From the decision [PDF]:

Defendants contend that Plaintiffs have also failed to satisfy the “substantial risk” inquiry. Plaintiffs allege that CBP data demonstrates that it is on track to conduct approximately 30,000 searches this fiscal year. Defendants point out, however, that those searches only amounted to 0.008% of the approximately 189.6 million travelers who arrived at U.S. borders during this period. Defendants argue that this future search probability—which they characterize as a “slight chance” of search—is not sufficient to establish standing here.

There is no numerical threshold, however, at which likelihood of harm becomes a “substantial risk” of harm. See Kerin v. Titeflex Corp., 770 F.3d 978, 983 (1st Cir. 2014) (noting that “a small probability of a great harm may be sufficient”). Although 0.008% may be a small percentage of total travelers, the searches still occur at an average of approximately 2500 searches per month. In SBA List, the Supreme Court supported its conclusion that there was a substantial likelihood of future harm with the explanation that proceedings enforcing the statute in question were “not a rare occurrence,” with twenty to eighty such cases occurring per year. Against this backdrop, 30,000 searches per year is not a “rare occurrence,” even if it makes up a small percentage of total travelers.

The government also argued allegations of future harm were too vague to support a lawsuit. The court finds this argument unbelievable, given the history of the plaintiffs' interactions with border agents and the agencies' border search practices.

Defendants also argue that Plaintiffs’ allegations of future harm are impermissibly “vague” and speculative. They point to Reddy for the proposition that in the First Circuit, “‘[s]peculation’ that a government actor ‘might in the future take some other and additional action detrimental to’ Plaintiffs, is ‘not an adequate substitute for a claim of specific present objective harm or a threat of specific future harm.’” In Reddy, however, the First Circuit held that the plaintiffs’ assertions of standing were speculative as to a New Hampshire buffer zone statute, emphasizing that the statute had not yet been enforced. Here, by contrast, Plaintiffs challenge policies that are in place and are being actively enforced.

[...]

Plaintiffs’ alleged future injury does not depend upon defendants’ future illegal conduct untethered to a pattern of past practice, cf. Los Angeles v. Lyons, 461 U.S. 95, 102 (1983) (concluding that plaintiff subject to illegal arrest procedure made no showing that he was likely to be arrested and subjected to illegal procedure again), but rather upon recurring conduct authorized by official policies. That is, Plaintiffs’ subjection to prior searches further bolsters their allegations of likely future searches.

The heart of the matter is the border search exception. It's what allows CBP and ICE to bypass the Supreme Court's Riley decision and its institution of a warrant requirement for device searches. The government seizes a single phrase from the Supreme Court ruling: "search incident to arrest." Its argument attempts to divorce border device searches from the Supreme Court's finding that searching cellphones was more analogous to searching houses than searching pants pockets or suitcases. The court doesn't agree with the government's distinction.

As an initial matter, the Court is not persuaded that Riley’s reasoning is irrelevant here simply because Riley’s holding was limited to the search incident to arrest exception, see Riley, 134 S. Ct. at 2495. Judicially recognized exceptions to the warrant requirement do not exist in isolation; rather, they are all part of Fourth Amendment jurisprudence, justified because, ordinarily, the circumstances surrounding the search and the nature of the search have been deemed “reasonable.”

[...]

Here, the First Circuit has not yet spoken on what level of suspicion is required to justify a cell phone or other electronic device search at the border. The First Circuit has, however, acknowledged the significant privacy interests implicated in a cell phone search, explaining that the information on these devices is “the kind of information one would previously have stored in one’s home and that would have been off-limits to officers performing a search incident to arrest.”

The court then goes on to say that merely raising the standard for invasive device searches to "reasonable suspicion" may not be enough.

[T]he Supreme Court rejected the reasonable suspicion standard when it came to cell phones because it “would prove no practical limit at all when it comes to cell phone searches.” Digital device searches at the border, perhaps even when supported by reasonable suspicion, raise the same concerns.

This is encouraging, even if all that's happened at this point is the case surviving the government's motion to dismiss. It provides plenty of insight into the court's thinking, and shows how much of it is at odds with the government's assertions. This has the potential to restore some Fourth Amendment protections at our nation's borders for the first time in years.

Filed Under: 1st circuit, 4th amendment, border searches, cbp, dhs, ice, warrants
Companies: aclu, eff

Privacy Group Files Legal Complaint Over UK Law Enforcement's Warrantless Phone Searches

from the we-did-it-because-no-one-said-not-to dept

Privacy International, which has successfully challenged UK surveillance programs, is bringing its heat to the local level. In a report PI released towards the end of March, the group noted several law enforcement agencies were seizing and searching phones -- often deploying forensic software -- without warrants. This went further than devices owned by criminal suspects. Searches were also performed on phones of crime victims and witnesses.

At no point does it appear warrants were sought. Documents obtained by PI showed UK police forces are operating under a melange of self-written policies or citing random portions of the Police and Criminal Evidence Act (PACE) to support their warrantless searches. It also appears there is no national oversight of this process, which has allowed this current policy patchwork to develop.

This is working out badly for UK citizens, as Privacy International points out.

Data can be taken from victims, witnesses and suspects without informing them. With no clear policies or guidance on the use of this technology, individuals are unaware of their legal rights in terms of:

- Whether data is only taken when necessary and proportionate;

- Getting the police to delete this data when there is no legal reason to retain it, particularly if they are innocent of any crime;

- Ensuring data is held securely to prevent exposure of their personal data as a result of loss of records, misuse or security breach.

Since it appears leaving law enforcement agencies to their own devices (and those owned by others) is only making things worse, Privacy International is pressing the issue.

Campaigners from U.K.-based Privacy International have formally complained about British police being able to download the contents of people’s phones—phones, photos, even fragments of deleted conversations—without a warrant.

While warrants are required to do this in countries such as the U.S., in the U.K. dozens of police forces point to various pieces of legislation to support the idea that they don’t need them. Privacy International says the practice is illegal, however, and has complained to the Information Commissioner’s Office, the British privacy regulator.

PI points to the UK's Data Protection Act, which provides protection for citizens from government harvesting of data and communications. This is being circumvented by common law enforcement practices that neither inform device owners of the extent of the search nor seek informed consent before performing forensic searches. On top of that, data housed in devices may fall under other protections as well. Phones can contain privileged communications with legal representation or information about journalists' sources.

It also notes the updated Data Protection Act, meant to align the UK with the EU's General Data Protection Regulation, will make these efforts even more illegal than they already are. PI is pretty sure law enforcement agencies won't have these policies rewritten before the new law comes into force, which means its complaint will still be on solid legal ground even after the new law is enacted.

This is what happens when law enforcement obtains powerful tech but answers to almost no one. The lack of oversight -- at local or national level -- has allowed law enforcement to perform invasive searches with a minimum of notification or paperwork. Hopefully, this will change soon.

Filed Under: phone searches, privacy, uk, warrants
Companies: privacy international

ICE Performs Warrantless Raid Of Private Farm; Draws Heat From State And Federal Officials

from the 'rule-of-law,'-my-ass dept

A recent ICE raid of a New York farm made national headlines thanks to the agency's apparent disregard for the Fourth Amendment, among other things. The show of force, coupled with the lack of Constitutional compliance, presented ICE as ruthless enforcers of the law. But there's not much respect for the "rule of law" contained in these actions, no matter how the current administration -- with its emphasis on expelling foreigners from the US -- presents itself.

John Collins was standing outside the milk house at his dairy farm this morning when he heard yelling coming from inside. He ran in, he says, and saw his worker, Marcial de Leon Aguilar, pinned up against the window by armed men.

The men did not identify themselves and were screaming at Aguilar, Collins said.

"I run and say, 'What the hell is going on in here?'" Collins said.

Then the men told Collins they were officers with Immigration and Customs Enforcement. He asked them for a warrant or some paperwork to explain what they were doing. They had none, he said, so he ordered them to get off his property and leave Aguilar alone.

As this happened, Collins said, Aguilar's children watched. They were waiting nearby for the school bus to come. Collins said the officers put Aguilar in handcuffs and took him across the rural road to their vehicles. At least seven officers had come onto the small farm, Collins said.

This resulted in immediate backlash from prominent New York government officials. Governor Andrew Cuomo sent an angry letter [PDF] to the agency chastising it for its apparent refusal to respect Constitutional protections.

Your agency's aggressive claims of upholding the rule of law belie the fact that the pattern of conduct and blatant constitutional violations committed by both agents in the field and regional leadership actually reflect a readiness to sink to lawlessness.

[...]

The persistent failure of your agents to properly identify themselves or produce required documentation to conduct lawful searches and arrests is illegal and creates significant risk of harm to all New Yorkers, including law enforcement who have also been left unaware of your activities within the communities they are entrusted to protect.

NY Senator Kirsten Gillibrand followed the governor's letter with a demand for a federal investigation.

Unbelievably, ICE thinks its actions -- a warrantless raid conducted on private property -- are Constitutional.

Agents were within their rights to be on the farm and did not need a warrant, ICE spokesperson Khaalid Walls told [Vice Media's Eoin Higgins] in an email. The agency said that its actions were justified because de Leon-Aguilar's wife Virginia, who is enrolled in the Alternatives to Detention program, which allows her to stay out of immigration detention while she goes through immigration court proceedings, had missed a number of appointments.

"After having missed several scheduled reporting dates," said Walls, "the resident was deemed to be out of compliance with the terms of the program, necessitating a home visit, which does not require a judicial warrant."

This is wrong. First of all, the raided farm was private property. Even if a home visit was in order, the home resided on property owned by someone else. This wasn't a rental property with only a door separating residents from the outside world. And this was no "home visit." The plainclothes ICE officers showed up, trespassed on private property, and effected an arrest. No permission to enter was sought and no warrant was presented.

ICE can't honestly say it doesn't need warrants to perform these actions. Its own training manual (published by Unicorn Riot) stresses the need for warrants. Searches still require warrants, even if they're looking for illegal activity. ICE can search businesses for illegal workers, but it still needs "Blackie's" warrants (named after a 1981 case brought against the INS), which allow the government to search for people, rather than property. There is no known warrant exception to intrude on private land to search for illegal workers. ICE may feel the Alternatives to Detention program gives it the right to search homes occupied by members of the program (and it does), but when the home resides on property owned by a US citizen, the barrier to entry remains a search warrant. The immigrant arrested in this case had proper documentation to work and resided in a house owned by John Collins on the Collins' property. To reach the house, ICE had to enter private property owned by someone ICE had zero interest in: a legal resident and American citizen.

The lawsuit that's certain to follow this intrusion will sort out the Constitutionality of ICE's actions. At this point, they appear completely unconstitutional, but qualified immunity and the good faith exception may allow the agency to escape liability for the actions of its officers.

Filed Under: 4th amendment, andrew cuomo, ice, immigration, john collins, kirsten gillibrand, marcial de leon aguilar, new york, private property, warrants

Unsealed Warrant Shows FBI Investigated Michael Hayden For Leaking Info To Journalists

from the who-watches-the-watchers-watching-the-watcher-watcher? dept

Kevin Poulsen of The Daily Beast has obtained a warrant application showing even the most ardent of surveillance state defenders aren't immune from the all-seeing eyes they feel are ever so essential to keeping this nation safe. It appears none other than former NSA and CIA boss Michael Hayden was subjected to the government's magnifying glass for allegedly leaking sensitive information to reporters.

The FBI sought a search warrant for the email account of former CIA and NSA chief Gen. Michael Hayden in 2012, according to a newly unsealed court filing. The warrant application was part of a broader Obama-era investigation into a leak of classified information to the press. Another official later pleaded guilty in connection to the disclosure.

The targeting of Hayden’s AOL email account drives home just how aggressively the Obama administration pursued leaks, in this case following a relatively thin lead all the way to the private email account of a retired four-star general. Hayden served as director of the National Security Agency from 1999 to 2005, and later led the CIA until his retirement in 2009.

And it is a very thin lead. All that's included in the warrant affidavit [PDF] is the fact that Hayden engaged in email conversations with two unnamed reporters a total of 30 times in 18 months. Given his position, it's surprising it didn't happen more often. Officials are always contacted by reporters when writing about subjects/programs/etc. they oversee. In the affidavit, the special agent notes many of these contacts were to "confirm quotes" to be used in published articles and books.

The inquiry here apparently centered on news of the Stuxnet virus and the US's involvement in the cyberattack. The only quote about Stuxnet attributed to Hayden was fairly innocuous, stating only that this was the first time a cyberattack had been used to "effect physical destruction."

As Poulsen points out, this investigation lead to a dead end, at least as far as its pursuit of Hayden as a leaker.

The FBI found no evidence that Hayden did anything wrong. But using similar tactics, the FBI eventually tracked the story to retired Marine Gen. James Cartwright. In 2016 Cartwright acknowledged he was a source for the article and pleaded guilty to a single count of lying to the FBI. Cartwright’s prosecution was widely criticized by freedom-of-the-press groups and government insiders, and Obama pardoned Cartwright shortly before leaving office.

What this dead-ended investigation does show is how aggressively our government pursues leakers and whistleblowers. NSLs, warrants, and anything else the government might find useful are being deployed to sniff out journalists' sources. The government may hesitate to place a journalist under direct surveillance, but it has no problem achieving the same ends by deploying these backdoor searches. Working its way backwards from government employees, the government can sweep up communications that would raise serious First Amendment issues if approached head-on. And it obviously has no qualms about grabbing the personal communications of team players who've fully bought into the system.

Filed Under: cia, fbi, james cartwright, leaks, michael hayden, nsa, warrants, whistleblowing, witch hunts

DOJ Asks Supreme Court To Dump Microsoft Case, Let It Use New CLOUD Act To Demand Overseas Data

from the sighs-and-eyerolling-from-DOJ-counsel dept

As expected, the DOJ has asked the Supreme Court to toss the Microsoft case. The appeal sitting before the court deals with collecting data overseas using US-issued warrants, rather than mutual assistance treaties. As the DOJ argues in its motion to vacate [PDF], the passage of the CLOUD Act -- stapled to the tail end of 2,200-page budget bill -- makes this argument moot. For all intents and purposes, the new law (which apparently still has no effective date) grants the government the power to demand production of data stored overseas by US companies using a regular magistrate's warrant.

The motion goes further than just asking the Supreme Court to drop the case. It also takes some time to complain about Microsoft inconveniencing the DOJ by forcing it to acquire another warrant for the same info under the newly-granted authority. The DOJ, despite its apparent compliance with Microsoft's request, spends a few paragraphs explaining why it shouldn't need to do the thing it already did.

The application of the CLOUD Act to the original Section 2703 warrant at issue in this case would not be retroactive. Microsoft’s production of the requested information has not been “completed,” Landgraf, 511 U.S. at 270, as it remains possible for Microsoft to comply fully with the government’s demand for disclosure. The Section 2703 warrant remained valid after the CLOUD Act, and no real consequences have attached to Microsoft’s failure to comply with the warrant up to this point.

[...]

Nevertheless, Microsoft has refused to acknowledge either that the CLOUD Act applies to the Section 2703 warrant at issue in this case or that Microsoft plans to disclose the required information under the original warrant.

Microsoft's objection hinges on unresolved contempt charges stemming from the case it successfully appealed twice. According to Microsoft, its compliance with the old warrant might trigger retroactive charges, which would be problematic for it. The DOJ points out no sanctions were ever threatened by the district court, which only entered contempt charges to allow the decision to be appealed.

Nonetheless, an exasperated DOJ has complied with Microsoft's demand that a new warrant issued under the CLOUD Act be provided.

Accordingly, on March 30, 2018, the government applied for a new warrant covering the relevant information requested in the Section 2703 warrant at issue in this case. A magistrate judge issued the warrant that same day. Under the new warrant, which will replace the original warrant and which the CLOUD Act indisputably governs, Microsoft must produce any covered information within its “possession, custody, or control.” CLOUD Act § 103(a). Microsoft no longer has any basis for suggesting that such a warrant is impermissibly extraterritorial because it reaches foreign-stored data, which was the sole contention in its motion to quash.

And it returns to the subject again to remind the court how much of a pain in the ass Microsoft is being about all of this.

The government does not believe that seeking a new warrant was necessary in order to compel Microsoft to act: In light of the CLOUD Act, Microsoft should have simply complied with the existing warrant, to which it can have no valid legal objection...

The last loose end the government seeks to have tied up is the appeals court decision, which the DOJ claims could cause future jurisdictional issues for warrants issued by that circuit. It also lets the Supreme Court know it thinks the lower decision should also be vacated because it's just so (subjectively) wrong.

Leaving the court of appeals’ decision in place as circuit precedent could therefore generate uncertainty in future extraterritoriality, Fourth Amendment, or subpoena cases arising in the Second Circuit. Given the serious flaws in the court’s reasoning, this case implicates the traditional need for vacatur to “clear[] the path for future relitigation of the issues” and to “eliminate[] a judgment, review of which was prevented through happenstance.”

The DOJ gets the win it wanted, but won't have circuit precedent to rely on. Instead, it got a whole new law to use to force US companies to turn over data stored outside of the US. It will now be able to meddle in international affairs and open the door for similar meddling by other countries not quite as respectful of civil liberties as we are.

Filed Under: 4th amendment, cloud act, data, doj, due process, overseas data, privacy, subpoenas, supreme court, surveillance, warrants
Companies: microsoft

Appeals Court Has No Problem With Cops Using E911 Services To Perform Warrantless, Real-Time Tracking

from the what-part-of-'stored'-do-you-fail-to-comprehend? dept

The Fifth Circuit Appeals Court says it's fine if the government uses mandated emergency services to perform real-time GPS tracking. It doesn't go so far as to affirm the constitutionality of the actions, but it achieves the same ends by voting down the appellant's request for a rehearing.

What we can glean about the issue at stake comes from the eight-page dissent [PDF] written by judges James L. Dennis and James E. Graves, two of the seven judges who voted for a rehearing. In this case, the government used the defendant's cellphone provider to engage in real-time tracking. No warrant was obtained despite the government's shoulder-surfing of incoming GPS location data.

Defendant William Wallace contends that the Government violated the Fourth Amendment by ordering his service provider to activate his phone’s “Enhanced 911” capability and to relay his GPS coordinates in real time, including while he was in his home. The panel opinion concludes that, even if the Government’s real-time tracking of Wallace’s GPS coordinates was an unconstitutional search, Wallace cannot benefit from the exclusionary rule suppression of the fruits of that search because law-enforcement officials could have reasonably relied on open-ended language in 18 U.S.C. § 2703(c), a provision of the Stored Communications Act (SCA), as authorizing their actions.

Those are the facts of the case, but as the dissenting judges point out, the SCA clearly did not anticipate this use of the law, much less explicitly approve this GPS warrant end-around utilized by law enforcement. The government relied on good faith exception arguments made in two cases -- Leon and Krull. The latter holds that officers may rely on clear statutory authorization even if the statute is later proven to be unconstitutional. (In the Krull case, the statute was struck down a day after the disputed search took place.) This seems about right as courts hardly expect officers to know the laws they're supposed to enforce, much less the ones they're supposed to follow.

But that doesn't hold here. The dissent makes it explicit: the SCA provides no basis for warrantless commandeering of a phone's GPS system to track suspects. This isn't a passive collection of existing records. This turns a phone into a tracking device at the behest of law enforcement, even when the phone's owner may have taken measures to limit the collection of GPS data. There's nothing in the SCA that says any of this is constitutional.

Unlike in Krull, here there is no legislative judgment or dialogue between the courts and the legislature as to the constitutionality of the realtime GPS surveillance at issue. Congress passed the SCA over thirty years ago. At that time there was no E911 requirement, see 61 FED. REG. 40,374, and GPS was still experimental military technology that would not begin to be in widespread civilian use until over a decade later…

Furthermore, there's a Supreme Court decision to be considered -- one that strongly hinted real-time GPS tracking requires warrants (even if the Justices didn't actually go so far as to draw a bright line).

Moreover, as has been expressed by five members of the current Supreme Court and by members of this court, there is grave doubt as to the constitutionality of the kind of warrantless, real-time GPS tracking at issue in this case. See, e.g., United States v. Jones, 565 U.S. 400, 415–18 (2012) (Sotomayor, J. concurring) [...] Thus, both the nature of the statute and the nature of the alleged constitutional violation strongly suggest that Krull does not apply here.

The dissent then returns to the SCA. The government argues the SCA should be read to include real-time GPS tracking as something covered by the "or other information" phrase in the law. Since it's not communications, the government rationalizes, there should be no warrant requirement. The dissent points out the flaw in the government's reasoning by pointing to nothing more than the name of the law invoked to perform the warrantless tracking.

This holding ignores plain language in the SCA suggesting that real-time collection of GPS tracking information is not authorized by this statute. Section 2703(c) is part of the “Stored Communications Act.” (emphasis added). The pertinent section is entitled “Records concerning electronic communication service or remote computing service.” § 2703(c) (emphasis added). GPS coordinates that have not yet been created and would not be created absent the Government’s intervention cannot be called “records” or “stored” communications under any commonsense understanding of those terms.

This does nothing for the appellant or anyone who resides in the district, unfortunately. Law enforcement can still turn phones into tracking devices without warrants, barring any state legislation that provides more privacy protections than this district's interpretation of the Fourth Amendment. With its refusal to rehear this case, the Fifth Circuit has granted the government the luxury of interpreting "or other records" to include compelled real-time GPS tracking.

Filed Under: 4th amendment, 5th circuit, e911, police, privacy, real time tracking, surveillance, warrants

House Staples Extraterritorial Search Permissions Onto 2,232-Page Budget Bill; Passes It

from the hearty-debate-was-enjoyed-by-none dept

Just as the Supreme Court is considering the legality of extraterritorial demands for communications held by US internet service providers in overseas data storage, Congress is doing all it can to short-circuit the debate. Tucked away towards the back of a 2,200-page spending bill is something called the "Clarifying Lawful Overseas Use of Data Act" or (of course) "CLOUD Act." (h/t Steve Vladeck)

The CLOUD Act [PDF - starting at p. 2201] would make any decision by the Supreme Court extraneous. If it agrees with Microsoft -- as lower courts have -- that the US has no right to demand communications stored overseas with a normal warrant, the Act would immediately overturn the decision. If it decides against Microsoft, it will be aligned with the new law. As it stands now, the route most likely to be taken by the Supreme Court is a punt. Legislation on point is in play and the Court will probably be more than happy to let legislators make the final call.

Beyond the obvious problem of giving US law enforcement permission to use regular warrants to bypass mutual assistance treaties, the law also allows for reciprocation. We can't go around waving SCA (Stored Communications Act) warrants in foreign lands without expecting pushback from locals. So, we'll have to give foreign countries the same privileges, even if the criminal charges being investigated wouldn't be considered criminal acts in this country and the country enjoying this reciprocation doesn't care much about its own citizens' rights and privacy.

The EFF is especially critical of the shoehorned-in CLOUD Act. As it points out, the law would result in backdoor searches of anyone's communications via reciprocal communication demands. In the US, we've already seen the Fourth Amendment circumvented by US government agencies via their access to NSA collections. The same would happen in reverse when other countries start playing by the CLOUD Act's new rules.

When foreign police use their power under CLOUD Act executive agreements to collect a foreign target’s data from a U.S. company, they might also collect data belonging to a non-target U.S. person who happens to be communicating with the foreign target. Within the numerous, combined foreign investigations allowed under the CLOUD Act, it is highly likely that related seizures will include American communications, including email, online chat, video calls, and internet voice calls.

Under the CLOUD Act’s rules for these data demands from foreign police to U.S. service providers, this collection of Americans’ data can happen without any prior, individualized review by a foreign or American judge. Also, it can happen without the foreign police needing to prove the high level of suspicion required by the U.S. Fourth Amendment: probable cause.

In addition, the law allows the US to enter into agreements with almost any country on earth, even those whose respect for human rights is nearly nonexistent. There's a provision in the law that says countries must meet a vague human rights standards before they're allowed to start searching US-based cloud services, but those guidelines are roughly 100% useless. Unless a more rigorous vetting standard is applied, countries like Turkey could soon be trawling for US persons' communications. As the ACLU points out, Turkey might still be considered to be compliant with the humans rights guidelines despite its ever-increasing level of citizen-directed abuse.

For example, in early 2014, Turkey may have met the CLOUD Act’s vague human rights criteria; Freedom House even rated it a three and four on its index for political and civil rights. But since the attempted coup in mid-2016, the Turkish government has arrested more than 50,000 people — including journalists and activists such as the chair and director of Amnesty International’s Turkey section — many on bogus terrorism charges. According to U.N. experts: “Most of these accusations of terrorism are based solely on actions such as downloading data protection software, including the ByLock application, publishing opinions disagreeing with the Government’s anti-terrorism policies, organizing demonstrations, or providing legal representation for other activists.”

Under the CLOUD Act, neither Congress nor U.S. courts would be able to prompt a review or a temporary moratorium for a case like Turkey. Users, without notice, would have little practical ability to lodge complaints with the U.S. government or providers. Even if the U.S. government were to take action, the CLOUD Act fails to ensure a sufficiently quick response to protect activists and others whose safety could be threatened.

What few positives the bill provides revolve around challenging demands for communications. The bill provides avenues for US tech companies to challenge orders targeting foreign servers, as well as pushing back against foreign government demands for communications held in the US. But these will mainly be of use to the largest tech companies with the manpower and legal acumen to throw at the problem. Smaller companies will likely just find themselves handing over anything to anyone who comes asking, rather than risk punitive action by domestic and foreign governments.

And the standards are extremely weak. While the bill claims to hold foreign countries to US standards, it never specifically says foreign countries demanding communications need to have US-equivalent rights. It refers to "international universal human rights" which sounds great, but this is a feel-good term that isn't recognized by US or international law.

Even if communications are subject to some restrictions, metadata isn't. Anything foreign governments collect on American citizens can be handed over to the US government without further legal review. And it carves out a hole for wiretapping electronic communications, allowing demands like these to bypass the privacy protections of the Wiretap Act.

Considering it's been stapled to end of must-pass funding bill, chances are the bill will receive zero debate before being forwarded to the president. The House has already passed its version, which means the Senate needs to step up to block the CLOUD Act stuffed into its spending bill. As we saw during the last several months of 2016, very few reps were in any hurry to challenge the expansion of Rule 41 authorities, despite having more than a year to generate opposition. Even when time is a luxury, inaction is the preferred response. The CLOUD Act, hidden under more than 2,000 pages of funding requests, is probably as close to a sure thing as it's ever been. And it will do little more than further damage privacy protections across the globe.

Filed Under: cloud act, extraterritorial, jurisdiction, omnibus, privacy, search, stored communications act, surveillance, warrants

DOJ Readying Warrants In Carter Page Investigation For Public Release

from the giving-the-Republicans-what-they-may-not-want dept

For the first time since the FISA court opened for national security business, the DOJ is considering declassifying FISA warrant applications. The documents are linked to the FBI's surveillance of former Trump campaign aide, Carter Page. Both sides of the political aisle have asked for these documents, which is something you'd think they'd have wanted to see before issuing their takes on perceived surveillance improprieties.

Devin Nunes -- following the release of his memo -- sent a letter to the FISA court asking it to clear the warrants for public release. The court's reply, penned by Judge Rosemary Collyer, pointed out two things. First, the FISA court had never released these documents publicly, nor was it in the best position to do so. It is only tasked with determining whether or not surveillance is warranted and to what restrictions it must adhere. It does not have the innate power to declassify documents, nor can it arbitrarily decide what documents have gathered enough public interest to outweigh the government's perpetual demands for secrecy.

The court did point out this release could be achieved much faster if Nunes directed his question to the DOJ, which does have the power to declassify its own investigation documents. It doesn't appear Devin Nunes has approached the DOJ but litigants in an FOIA lawsuit have, and they're looking at possibly obtaining the documents Devin Nunes requested from the FISA court.

The government is considering an unprecedented disclosure of parts of a controversial secret surveillance order that justified the monitoring of former Trump campaign aide Carter Page.

Responding to a legal challenge brought by USA TODAY and the James Madison Project, Justice Department lawyers Friday cast the ongoing review as “novel, complex and time-consuming.”

“The government has never, in any litigation civil or criminal, processed FISA (Foreign Intelligence Surveillance Act) applications for release to the public,” Justice lawyers wrote in a five-page filing.

The filing [PDF] notes that the President's unilateral decision (over the DOJ's objection) of releasing the Nunes memo has forced it to reverse some of its Glomar declarations in ongoing FOIA lawsuits, since it's impossible to maintain a stance of non-confirmation and non-denial when the White House is handing out confirmation left and right.

The DOJ has asked for four months to review the documents before returning to the court with its final answer on public release. There will probably be further delays from this point, as the DOJ will need the FISA court to officially unseal documents before it can turn these over to the litigants. It notes the plaintiffs are not happy with this timetable, but points to the presumed complexity of a task it has never undertaken previously as the reason it needs 120 days before the litigation can move forward.

This administration continues to break new grounds in inadvertent transparency. However, the release of these documents may further undermine the Nunes Memo narrative, so legislators and White House officials hellbent on using the FISA court to score political points should be careful what they wish for.

Filed Under: carter page, devin nunes, doj, fbi, fisa court, fisc, warrants

Cops Wanting To Track Movements Of Hundreds Of People Are Turning To Google For Location Records

from the wherein-'probable-cause'-is-defined-as-'maybe-this-might-be-helpful? dept

Police in Raleigh, North Carolina are using Google as a proxy surveillance dragnet. This likely isn't limited to Raleigh. Google harvests an astounding amount of data from users, but what seems to be of most interest to law enforcement is location info.

In at least four investigations last year – cases of murder, sexual battery and even possible arson at the massive downtown fire in March 2017 – Raleigh police used search warrants to demand Google accounts not of specific suspects, but from any mobile devices that veered too close to the scene of a crime, according to a WRAL News review of court records. These warrants often prevent the technology giant for months from disclosing information about the searches not just to potential suspects, but to any users swept up in the search.

The good news is there are warrants in play. This likely isn't due to the PD's interest in "balancing civil rights with public safety," no matter what the government's frontmouths have stated to the press. The WRAL report includes a warrant request containing a footnote indicating Google pushed back when the cops showed up with a subpoena demanding info on everyone who had been in the vicinity of a crime scene.

The State of North Carolina maintains that the information sought herein consists entirely of "record[s]" other than the "content of communications…" Such records, require only a showing that there are reasonable grounds to believe the information sought is relevant and material to an ongoing criminal investigation… Despite this, Google has indicated that it believes a search warrant, and not a court order, is required to obtain the location data sought in this application. Although the Government disagrees with Google's position, because there is probable cause to believe the information sought herein will contain evidence of the criminal offenses specified in this affidavit, the Government is seeking a search warrant in this case.

But the bad news is that warrants are supposed to be tailored to specific searches related to specific suspects. These warrants are allowing law enforcement to obtain information on dozens or hundreds of people entirely unrelated to the criminal act being investigated, other than their proximity to the crime scene.

At least 19 search warrants issued by law enforcement in Wake County since 2015 targeted specific Google accounts of known suspects, court documents show.

But the March search warrants in the two homicide cases are after something different.

The demands Raleigh police issued for Google data described a 17-acre area that included both homes and businesses. In the Efobi homicide case, the cordon included dozens of units in the Washington Terrace complex near St. Augustine's University.

Cellphones -- and any other devices using Google products that serve up location info -- are steady generators of third party records. Conceivably, this puts a wealth of location info only a subpoena's-length away from the government. It appears Google is pushing back, but that tactic isn't going to work in every case. The Raleigh PD may have been willing to oblige Google to avoid a fight in court (and the risk of handing over information about how often it approaches third parties for records and what it demands from them), but not every PD making use of Google's location info stash is going to back down this easily.

Other warrants obtained by WRAL show local law enforcement has collected phone info and location data on thousands of people while investigating such crimes as arson and sexual battery. Despite having no evidence showing the perpetrators of these crimes even had a cellphone in their possession at the time the incidents occurred, agencies approached Google with judge-approved warrants to collect data on people living in nearby apartment units or visiting local businesses near the crime scene.

The government's attorneys believe everything is perfectly fine because no communications or other content is collected. But defense attorneys and rights advocates point out these warrants approach civil liberties from entirely the wrong direction, making everyone in the area a suspect before trimming down the list. In one way, it's a lot like canvassing a neighborhood looking for a suspect. But this analogy only holds if everyone officers approach is viewed as a suspect. This isn't the case in normal, non-Google-based investigations.

After five years as a Wake County prosecutor, Raleigh defense attorney Steven Saad said he's familiar with police demands for Google account data or cell tower records on a named suspect. But these area-based search warrants were new to him.

"This is almost the opposite technique, where they get a search warrant in the hopes of finding somebody later to follow or investigate," Saad said. "It's really hard to say that complies with most of the search warrant or probable cause rules that we've got around the country."

The Wake County District Attorney believes these warrants are solid enough to survive a challenge in court. The government may get its wish. Officers using these to obtain data will likely come out alright, thanks to good faith reliance on approved warrants, but the magistrates approving dragnet collection as an initial investigatory step may have some explaining to do.

The DA says it's just like watching business surveillance video when investigating a robbery. Lots of non-criminals will be captured on tape and their movements observed by officers. But the comparison fails because, in most cases, the criminal act will be caught on tape, limiting further investigation to the perpetrators seen by officers. In these cases, everyone with a cellphone within a certain distance of crime scene becomes a suspect whose movements are tracked post facto by officers who have no idea -- much less actual probable cause to believe -- that any of this data actually points to the suspect they're seeking.

Then there's the problem of effectiveness. Starting an investigation with a geofence and attempting to turn it into a bottleneck that will result in pursuable suspects doesn't seem to be working. According to the documents seen by WRAL, only one person has been arrested for any of the crimes in which police approached Google for data on thousands of users. And in that case, the location data law enforcement requested didn't show up until months after the suspect was charged. It may be there have been more success stories, but routine sealing of documents and warrants tends to make it impossible for anyone outside of the police department to know for sure. But the department knows. And if it has good things to say about this questionable search technique, it hasn't offered to share them with the rest of the public.

Filed Under: location info, north carolina, police, raleigh, surveillance, warrants
Companies: google

Supreme Court Hears Oral Arguments In Microsoft Email Case

from the in-which-the-DOJ-claims-the-DOJ-can-get-communications-from-anywhere-in-the-worl dept

The Supreme Court held oral arguments in the Microsoft case on Tuesday. The case centers on jurisdictional limits for warrants issued under the Stored Communications Act. The government believes there should be no limits, not if it serves the warrant domestically. Microsoft, the recipient, informed the US the communications it sought resided in an Irish server, beyond the reach of the SCA.

The Second Circuit, in consecutive decisions, found in favor of Microsoft. If the government wants access to communications stored in overseas servers, it needs to work with that country's government to obtain them. After all, the US government certainly doesn't want other countries deciding their laws take precedence over our own and bypassing assistance treaties to obtain communications stored here.

Or maybe it does. Or maybe the DOJ just doesn't care about collateral damage. Either way, its appeal is being heard by the Supreme Court, which has a chance to alter an old law (1986's SCA) in a bad way. The government got off on the wrong foot by claiming its demand for communications wasn't a search. From the transcript [PDF]:

[Michael] DREEBEN [DOJ Deputy Solicitor General]: Mr. Chief Justice, and may it please the Court: Section 2703 of the Stored Communications Act focuses on classically domestic conduct. It requires disclosure in a court order by the United States of information related to United States crime and here by a United States service provider.

JUSTICE SOTOMAYOR: It actually requires a search. It's -- the disclosure here is really a substitute for the government's searching. The Act permits the government to have a warrant and go in and search for these materials or, in the alternative, to ask the source to do its own search and then turn the materials over. So why -- you describe it as if it's only a disclosure, but it's really a search.

Dreeben argued that the demand for communications isn't a search because the search is performed by the service provider. While it's true the government isn't going into Microsoft data centers and digging through servers, the fact is the search would not be taking place if the government hadn't requested one to be performed. It may be outsourcing the actual search, but Microsoft has zero interest in these communications until the government steps in and says it wants them. Dreeben is splitting hairs, but they're hairs that have been split for more than 30 years, when the SCA granted the government the power to obtain certain records and communications from service providers.

The government's lawyer also asserted that the SCA explicitly provides for the acquisition of overseas data. But the arguments made show that isn't the case. It governs production of data by US service providers. It says nothing about demanding they produce info stored in other countries. The DOJ wants the law to be read as allowing for the acquisition of overseas data, so long as the warrant is served in this country.

Justice Sotomayor challenged this assertion, pointing out a couple of relevant things. First, the law is more than 30 years old. Second, the point of territorial limits (one of them) is to avoid upsetting the international apple cart.

This is a 1986 statute. The reality in 1986, if you look at the statute and its reference to stored records, to stored communications, was -- it's a past technology, old concept. But I think it's fair to say that back then they were thinking that where these materials were stored had a geographic existence in the United States, not abroad or nowhere else, and that they were protecting the communications that were stored in particular locations.

Things have changed. But what you're asking us to do is to imagine what Congress would have done or intended in a totally different situation today. And the problem that Justice Ginsburg alludes to is the fact that, by doing so, we are trenching on the very thing that our extraterritoriality doesn't want to do, what our jurisprudence doesn't want to do, which is to create international problems.

She went on to note there's legislation in the works that would lift territorial limits in cases like these, but limit (or attempt to) international fallout. Why not leave things the way they are and let Congress sort it out? The DOJ's response is basically that Microsoft manufactured a problem with its refusal to comply with the SCA order, and now the US is out of step with data acquisition treaties made by (and with) other countries around the world.

The justices aren't all that thrilled with Microsoft's arguments either. Justice Alito pointed out Microsoft complied with SCA warrants prior to this challenge and that it always has the option to voluntarily disclose communications to the government. (The response from Microsoft's lawyer -- E. Joshua Rosenkranz -- is that doing this would violate its relationship with its customers, who assume the company won't just hand over info to law enforcement without being ordered to.)

There was also some discussion about the location of the servers and why this shouldn't matter when it comes to responding to a court order. Rosenkranz pointed out that the DOJ still couldn't access overseas emails even if it shoved the Microsoft employee aside and performed the search themselves. The instructions sent to retrieve the emails "land" in Ireland and the retrieval process begins, no matter who initiates the search. Trying to skirt territorial limits by using a domestic proxy doesn't make it any less of a violation of domestic statutes or, in the case of Ireland, Ireland's privacy laws.

It comes down to location, as Microsoft sums up. The fact that the papers sought are ones and zeroes should make no difference.

[T]he government asks this Court to grant it an extraordinary power, and it's a power that Congress did not think it was granting law enforcement in 1986, and certainly did not intend to grant to every police officer and every sheriff's deputy anywhere in the country. Back then, if the police needed to gather evidence from all over the world, they would have to engage with law enforcement everywhere else in those countries.

And they have the tools to do that, even though the DOJ portrays those as pretty much unworkable. Rosenkranz's take is a little more optimistic.

JUSTICE ALITO: All right. Well, all right. The service provider has chosen to store it overseas. There's no way to get the information, other than through these -- these very time-consuming MLAT procedures?

MR. ROSENKRANZ: Well, Your Honor, the way to get the information is through MLATs, and the only evidence in this record about MLATs is that MLATs do work. If it's urgent for the government, the other governments respond urgently.

It's hard to say where the court's sympathies lie. No one seems too impressed with Microsoft's assertions it doesn't have to respond to domestic warrants simply because someone chose to store their communications overseas. But, by the same token, no one's sold on the DOJ's assertions the SCA provides for extraterritorial searches. And, given its multiple appearances in the arguments, the court may simply decide to maintain the status quo and let Congress sort it out. This will force the DOJ to play by territorial guidelines until new laws are in place. It won't be happy, but it managed to get the Rule 41 rewrite it wanted which allows it to execute warrants anywhere in the US, no matter where they were issued.

The SCA needs a rewrite, but a rewritten law that considers the DOJ to be the prominent stakeholder isn't going to fix anything. Criminals have off-shored evidence for years now. A ruling for the status quo won't substantially increase the number of scofflaws stashing communications on foreign servers, but a ruling against it would definitely damage international relationships, if not numerous internet-based communication platforms. The DOJ would like the Supreme Court to rewrite laws on the fly, which really isn't its job. If the court decides it's going to stay in its lane with this case, chances are Microsoft comes away with a win, even if it ends up being a momentary victory.

Filed Under: 4th amendment, jurisdiction, sca, stored communications act, subpoenas, supreme court, warrants
Companies: microsoft