Another Federal Court Says No Warrants Needed To Obtain Historic Cell Site Location Info

from the personal-tracking-devices dept

The Supreme Court has yet to examine the issue of historical cell site location info(CSLI). It finally picked a case from the Sixth Circuit to review, years after the warrantless gathering of historic CSLI became a thing. So far, there's not a single court in the nation that's found historic CSLI to have an expectation of privacy. The Fourth Circuit Appeals Court briefly did, before reversing its own decision. The original decision had problems with the amount of CSLI gathered: 221 days worth. Upon further review, the court sided with the government and its Third Party Doctrine arguments.

This federal court decision from the Southern District of New York name-checks the pending SCOTUS review, but falls in line with every other decision in the federal court system. The defendant sought to suppress historic CSLI obtained without a warrant, arguing the collection of location data by cell companies is not the same thing as "voluntarily" turning these records over to a third party. (via Courthouse News Service)

From the decision [PDF]:

The relevant question here is whether Serrano voluntarily provided his location to his service provider such that he had no legitimate expectation of privacy in it. The complexity of that question is compounded by the public’s general ignorance regarding the mechanics of how cell phones function, the type of information collected by service providers every time a cell phone is used, or the scope and frequency with which such information is recorded. Serrano contends principally that the third party doctrine has no application to CSLI because it is “not knowingly and intentionally conveyed by the cell phone user to anyone but rather generated automatically by radio waves.” (Mot. at 15–16.) Serrano argues that cell phone users do not actively submit their location information to service providers, nor are they even aware that such information is recorded by service providers without their express consent.

The court disagrees with the defendant's assessment. While it does recognize cellphones are as omnipresent as air, the generation of location data is a necessary function of cell service. Customers -- even if they aren't familiar with the specifics -- do have a general idea their movements are being tracked by every cell tower they connect to.

Though cell phone users do not affirmatively disclose their location to service providers, or understand the breadth of information that is collected through a single phone call, they do know that cell service is necessary to activate their phones. At a minimum, when none of the service bars appear on the interface of a phone, users know that they are “outside the range of the provider company’s cell network.” And when they are in service, they understand that they must “transmit signals to cell towers within range, that the cell tower functions as the equipment that connects the calls, that users when making or receiving calls are necessarily conveying or exposing to their service provider their general location within that cell tower’s range, and that cell phone companies make records of cell-tower usage.” While most people may not be aware of a cell tower’s esoteric functions, they nevertheless understand that by simply placing a call or receiving a text message, they are voluntarily disclosing something location-based and are cognizant that such information will then be used by service providers for a variety of purposes.

The court then goes on to make the argument that even if users weren't voluntarily providing this data, the government would still be able to obtain it without a warrant because the information itself has no expectation of privacy.

However, that a person voluntarily discloses information to third parties does not end the Fourth Amendment inquiry. Privacy interests in such information may exist depending on their substance and nature. There is, of course, a difference between disclosing the phone numbers that are dialed to call someone and the details of a conversation arising from that call. Here, however, CSLI provides no details about a phone call other than the general vicinity where the user placed or received the call. Voluntarily disclosed location information corresponds not to the user’s precise location, but that of the nearest towers.

The court does seem to recognize the current jurisprudence on cellphone data can't remain the way it is now: tied to a 1979 decision (Smith v. Maryland) that predates (and could not have foreseen) the explosion in cellphone use.

It is almost as if cell phone users must relinquish some privacy interests—at least related to their location—as a prerequisite to using a device so embedded in everyday life.

As everything stands now, it's exactly that: cellphone users are generating tons of third party records that can be obtained without a warrant. This includes real-time and near-real time tracking of people's location through tower pings or cell site simulators. For the most part, courts have been extremely hesitant to erect warrant requirements for so-called Third Party records.

This needs to change. Privacy expectations have changed. While most people are aware certain records must be generated to ensure cell service, very few agree the government should be able to track their movements without a warrant, especially over a long period of time. In this case, thirteen MONTHS of cell site location info was obtained by law enforcement, putting the 221 days in the Graham case to shame. When the courts ask themselves what is "reasonable" in terms of expectations of privacy, they need to spend more time considering how much has changed in the world of communications since 1979.

Filed Under: 4th amendment, cell site location info, csli, location, warrants

DOJ Tells Court There No Need To Establish A Warrant Requirement For Stingray Devices

from the not-now,-not-ever,-no-matter-what-our-internal-rules-say dept

The DOJ is in court arguing the use of Stingray devices by the FBI and local cops shouldn't require a warrant. The government's lawyers are fighting a suppression motion by Purvis Ellis, charged with racketeering and the attempted murder of a police officer.

The events of the case happened in 2013, two years before the DOJ instructed federal agents to seek warrants when deploying Stingrays. For this investigation, the Oakland PD used a pen register order, as was the style at the time. (And perhaps still is. Despite the DOJ's internal instructions, warrant requirements are all but nonexistent when it comes to local law enforcement agencies' use of cell tower spoofers.)

As Cyrus Farivar points out, the PD's Stingray couldn't locate Ellis, so it brought in the FBI. All without warrants and all without informing the defense about the additional Stingray deployment.

Ellis was located in an East Oakland apartment several hours after a January 2013 shooting with the help of two stingrays. Prosecutors initially insisted that only one stingray was used, but, as was revealed last summer, that turned out not to be the case. The Oakland Police Department's own stingray was seemingly insufficient, so officers then called in the FBI, both times without a warrant.

The defendant is arguing the multiple warrantless Stingray deployments violated the Fourth Amendment. Considering the devices coax a location signal out of phones by aping cell towers, this differentiates Stingrays from more passive collections -- like the pen register the government didn't actually use.

The government, quite obviously, is arguing otherwise. It points out in its opposition motion [PDF] that it has all the warrant exceptions on its side:

Four gang members ambushed a young man in broad daylight, shooting him through the forehead from close range. The next day, those same men jumped, pistol-whipped and shot a police officer investigating the prior day’s shooting. The suspects then fled, armed with their own arsenal, as well as with the guns they had just stolen from the officer. Police surrounded the apartment complex where the men were thought to be hiding. Finding them quickly was essential. By shooting two people in a 27-hour period, the suspects – including the defendant Purvis Ellis – had just demonstrated an ability and willingness to kill others. So, when officers used a cell site simulator (“CSS”) to find Ellis, they were entirely justified by the exigent circumstances presented, rightly believing him to be armed and dangerous.

The defendant’s motion to suppress is meritless. The courts have not definitively decided whether use of a CSS constitutes a “search” triggering Fourth Amendment protections. But it largely does not matter here, since exigent circumstances amply supported a warrantless use of the device.

[...]

Other exceptions to the warrant requirement also cut against suppressing evidence. For instance, the officers acted in good faith reliance on established law – the pen register statute, Supreme Court precedent, even the FBI policy at the time. Those laws and policies, combined with the dearth of binding case law on the CSS, all justified using the device without a warrant. In addition, the officers would have inevitably discovered everything they ultimately did, even had they never used the CSS. After all, they had the building surrounded by dozens of officers and SWAT team members hours before the CSS was even deployed.

It's a long list of counterarguments, most of which have some validity in this particular case. (That, of course, doesn't stop the government from using the same arguments in cases where its assertions of good faith, exigency, etc. are far more questionable. But that's how lawyering works… on both sides.)

It appears the government would rather the court didn't make a determination as to whether Stingray deployments are Fourth Amendment searches. The government lets the court know what it doesn't need to do to resolve this issue in the DOJ's favor:

Whether use of a cell site simulator constitutes a “search” for Fourth Amendment purposes is not necessarily a question this Court needs to answer, since even if it were a search, it was amply justified under the circumstances. That said, the law supports concluding that the device in this case did not affect a search.

The following argument, however, is particularly disingenuous. The defendant argued the warrant was invalid because officers didn't let the judge know they'd be deploying a Stingray device when it got its pen register order approved. The DOJ says this shouldn't matter, as it can find very little pre-2013 evidence suggesting these devices were mentioned in previous court documents.

Since the CSS technology was still relatively new in 2013, there were simply no binding cases to direct agents and officers to disregard Smith v. Maryland and get a warrant. According to the government’s research, only a few federal pre-2013 cases referenced “cell site simulator,” “digital analyzer,” “triggerfish,” or “stingray” in a relevant context. (The government found no such cases in California courts.)

Well, of course this search came up empty. For years, the FBI swore law enforcement agencies to secrecy if they acquired Stingrays, telling them to dismiss cases rather than have defendants, judges, or even some prosecutors discuss the tech in open court. The lack of DOJ search results means the NDAs the FBI forced everyone to sign worked.

By no means was CSS technology "relatively new" in 2013. Documentation of Stingray devices can be found dating back to 2006 and use of pre-Stingray "digital analyzers" dates back more than 20 years. There wasn't much courtroom discussion because the FBI actively prevented it from happening. And the DOJ knows this, as its "research" likely turned up things like this 2012 NDA on DOJ letterhead telling a New York sheriff's office to STFU about its new toy.

With no discussion, there are no binding cases. That's how the FBI wanted it. And it pays off years down the road by making it easier for the DOJ to prevail in a suppression argument without setting precedent it may find inhibiting another half-decade down the road.

Filed Under: 4th amendment, doj, stingray, warrants

Gov't Intercepted Millions Of Conversations In Single Drug Investigation, Netted Zero Convictions

from the Title:-III,-Privacy:-0 dept

The most intrusive of your tax dollars hard at work:

US authorities intercepted and recorded millions of phone calls last year under a single wiretap order, authorized as part of a narcotics investigation.

The wiretap order authorized an unknown government agency to carry out real-time intercepts of 3.29 million cell phone conversations over a two-month period at some point during 2016, after the order was applied for in late 2015.

This detail, contained in the US Courts' latest wiretap report, shows how much the government can get with a single wiretap order. Using assertions of "training and expertise," US drug warriors intercepted millions of phone calls, ringing up a $335,000 third-party phone bill in the process.

But hey, the Drug War can't be won without casting a wide dragnet. Drug conspiracies are vast and far-reaching, often leading law enforcement to bigger fish further down the line. Or so the affidavit assertions say…

But the authorities noted that the surveillance effort led to no incriminating intercepts, and none of the handful of those arrested have been brought to trial or convicted.

To recap:

1 wiretap warrant

$335,000 spent

3.3 million communications intercepted

0 convictions

The statutes governing wiretap warrants designate they should only be used when all other, less-intrusive investigative methods have failed. The fact that these 3.3 million communications failed to add up to a single conviction suggests other investigative methods weren't fully explored before a judge autographed this warrant request. To be fair to the judge, the requesting agency probably wasn't forthcoming about its previous investigative ventures.

But that's enough being fair to judges: Marcy Wheeler notes courts approving wiretap orders are even more of a rubberstamp than the FISA court.

The FISC report showed that that court denied in full 8 of 1485 individual US based applications, at a rate of .5%, along with partially denying or modifying a significant number of others.

The Article III report showed that out of 3170 requests, state and federal courts denied just 2 requests.

[...]

That’s a denial rate of .06%.

If there's good news to be gleaned from this report, it's that the number of wiretap orders obtained has dropped dramatically over the last year.

A total of 3,168 wiretaps were reported as authorized in 2016, compared with 4,148 the previous year. Of those, 1,551 were authorized by federal judges, compared with 1,403 in 2015. A total of 1,617 wiretaps were authorized by state judges, compared with 2,745 in 2015.

There's been a slight uptick in federal court approvals, but a dramatic downturn in state court approvals. Most of this drop can likely be linked to 0 being under the direction of a new District Attorney, who has stepped up to curb the wiretap abuses by his predecessor. For several years, the DEA -- which should be running its wiretap requests through federal courts -- was running its wiretap affidavits past an absentee DA and a very compliant (and efficient) state court judge.

Nearly all of that surveillance was authorized by a single state court judge in Riverside County, who last year signed off on almost five times as many wiretaps as any other judge in the United States. The judge's orders allowed investigators — usually from the U.S. Drug Enforcement Administration — to intercept more than 2 million conversations involving 44,000 people, federal court records show.

As USA Today's Brad Heath discovered, state court judge Helios Hernandez was a regular wiretap warrant printing press, which led to the DEA funneling a great deal of its requests through his courtroom.

Officials approved another 607 wiretaps in 2015, according to the figures released by the district attorney’s office. Most were approved in the first half of the year, before [new DA Mike] Hestrin said he installed a “stricter” standard that required every new wiretap application to have a “strong investigatory nexus” to Riverside County.

Taps have dwindled since then. So far this year [2016], Hestrin has approved only 14. In the first two months of last year, his office approved 126.

As Heath's report notes, this single DA's office and single state court judge were once responsible for 20% of the nation's state court-approved wiretaps. This no longer is the case, and the DEA's recent legal troubles associated with these questionable wiretaps has probably pushed it towards seeking more federal judges' signatures last year -- something it should have been doing all along.

Filed Under: drugs, intercepted calls, phone calls, warrants, wiretaps

Fifth Circuit Says No Warrants Needed To Obtain Near-Real Time Cell Site Location Info

from the prospective-records-just-records-apparently dept

The Fifth Circuit Appeals Court has issued a ruling on cell site location data which basically gives the government permission to engage in real-time tracking without a warrant. The acquisition of historical cell site location data is still the source of much judicial dispute. But at the federal appellate level, courts that have handled these cases have decided no warrant is needed. Location records are just another thing law enforcement can have warrantless access to, thanks to the Third Party Doctrine.

Prospective location records, like those obtained in this case, have received less scrutiny. While ostensibly third party records, these allow for "real-time" tracking of individuals using records flowing directly to law enforcement almost as quickly as they're obtained by the cell service provider. A defendant tracked using this poor man's Stingray moved to have the evidence suppressed, arguing the near-real time warrantless "search" violated his Fourth Amendment rights. The court disagreed, finding the momentary landing at the service provider was enough to make them third party records, even if law enforcement was figuratively (or possibly literally) hovering over the cell provider's shoulder as the location records rolled in. From the ruling [PDF]:

There is little distinction between historical and prospective cell site data. As in Historical Cell Site Data, here the government sought “the disclosure of the locations of cell site towers being accessed by [Wallace’s] cell phone” as recorded in future records “captured, stored, recorded and maintained by the phone companies in the ordinary course of business.” “While this information is ‘prospective’ in the sense that the records had not yet been created at the time the order was authorized, it is no different in substance from the historical cell site information . . . at the time it is transmitted to the government.” Booker, 2013 WL 2903562, at *7. The information the government requested was, “in fact, a stored, historical record because it [was] received by the cell phone service provider and stored, if only momentarily, before being forwarded to law enforcement officials.”

So, as it stands here (and in other courts), the government is free to obtain phone records from the past and the future -- and, with a "momentary" landing, location records as they're produced. As the court states here, third party records are third party records, whether or not they've been created yet. Even if the officers were wrong about this, the good faith exception would have allowed them to keep the fruits of their search, according to the court.

It's not a great decision. It allows law enforcement to ask for nearly any cell site location records without stating more than a few "articulable facts." An order could be fashioned to serve as open-ended surveillance, allowing officers to track someone for an indefinite amount of time without ever showing a law enforcement need to do so. It also could serve as cover for Stingray use by providing a parallel set of "real-time" location records.

What the decision doesn't explicitly do is give law enforcement permission to deploy Stingrays without warrants. Stingrays turn the government into the "third party," which isn't an acceptable use of the Third Party Doctrine. But that's another area federal courts really haven't delved into yet -- not because Stingray use is so limited, but because the FBI-enforced secrecy surrounding cell tower spoofers has prevented defendants from mounting many successful challenges. Charges tend to be dismissed if defendants get too close to the truth.

It's a published opinion so it has a little precedential weight. But the opinion spends more time quoting other opinions than breaking much new ground here. Unfortunately, the ground broken here is more victim-blaming, reminding defendants it's their own fault they use cellphones, as if most cellphones users were keenly aware their phones act as tracking devices… and as if it weren't a massive law enforcement boon that all of this info can be had without a warrant, thanks to a doctrine in severe need of a massive update.

Filed Under: 4th amendment, cell site location info, csli, searches, third party doctrine, warrants

ICE Using Stingrays To Track Down Immigrants Because Of Course It Is

from the high-value-targets-just-means-everyone dept

As information about police use of cell tower spoofers began leaking out, those who had kept the public (including defendants, judges, and even some prosecutors) out of the loop began defending their use of domesticated military technology. They said pay no attention to the possible civil liberties violations. Just think of all the good they're doing. They promised Stingrays would only be used on the worst of the worst, and only when time was of the essence: terrorists, murderers, kidnappers, etc.

But then even more Stingray documents made their way into the public domain. These showed the devices were deployed in bog-standard drug investigations or, worse, used just because agencies had them. This perhaps reached its nadir when a police department fired up its Stingray to hunt down someone who had stolen less than $60 worth of fast food. To make matters worse, the Stingray failed to track down the alleged thief.

Of course, anyone paying attention knew Stingrays would be used for nothing of importance, despite public officials' statements otherwise. The first person to start digging into Stingray use was Daniel Rigmaiden, who was doing time for fraud. Not exactly the sort of crime one would associate with exigent circumstances and possible danger to the public.

And, of course, because it's now the government's foremost priority to toss undocumented immigrants out of the country, Stingrays are being used to accomplish this goal. And, just like the defensive statements made on behalf of IMSI catchers, the federal government has claimed it's only interested in removing the most dangerous of undocumented individuals first. These statements are also false.

Federal officials in Detroit used a secretive tool known as a "Stingray" — which tricks cell phones into revealing their location — to find an undocumented man for deportation.

The cell-site simulator has been used in the past by federal and local law enforcement to find murder suspects, kidnap victims, drug dealers and terrorists — but sometime in March, FBI and ICE officials used it to find a 23-year-old native of El Salvador to deport him.

The alleged criminal act being used as leverage -- both for the Stingray deployment and the use of ICE's "eject" button -- is a long ways from the Parade of Horribles used to justify the acquisition and use of cell tower spoofers.

According to the warrant, Carcamo-Carranza was deported in 2012 and 2015 to El Salvador, but returned to the US.

In Feb. 28, 2016, he was arrested in Shelby Township, Michigan, on suspicion of hit-and-run, but was released by local police before he was detained by ICE agent.

Also of note: ICE used a warrant to pry loose this phone number, serving one to Facebook which gave it access to Carranza's private messages. Just throwing that in there to add a bit more skepticism for the "Going Dark" theory. A phone that might be locked isn't the end of the line for investigators, no matter how loudly law enforcement officials sigh during press conferences while gesturing ineffectively at a pile of seized devices.

As we always knew would happen, Stingray technology would soon shift from its more limited, "higher cause" deployment into just another tool for rote policework.

Filed Under: ice, immigration, privacy, stingrays, tracking, warrants

DA's Office Facing Multiple Lawsuits Related To Its Use Of Fake Subpoenas To Intimidate Witnesses

from the apparently-ethical-violations-are-just-part-of-the-office's-'traditions& dept

The Louisiana district attorney whose office issued bogus subpoenas to trick witnesses into "volunteering" their testimony is now facing multiple lawsuits. DA Leon Cannizzaro's office was sued on May 12th by the Roderick and Solange MacArthur Justice Foundation for its refusal to turn over copies of every fake subpoena it has issued.

Three days later, it was sued again, this time by the ACLU.

The ACLU lawsuit, filed Monday in Orleans Parish Civil Court, differs from a related lawsuit brought last week against Cannizzaro's office by the Roderick and Solange MacArthur Justice Foundation regarding the so-called Article 66 subpoenas.

The MacArthur suit seeks copies of every subpoena issued by the DA's office since 2013 -- those properly authorized by a judge, as well as the fraudulent "DA's subpoenas" intended to appear as if they carried legal weight.

The ACLU suit seeks the names and Louisiana Bar Association numbers of any attorney in Cannizzaro's office responsible for using one of the fake documents. An attorney who knowingly used a fraudulent document to compel witness testimony could be subject to penalties ranging from ethical misconduct sanctions by the Louisiana Attorney Disciplinary Board to the unlikely extreme of criminal charges brought by the state Attorney General's office related to forgery.

So far, Cannizzaro's office has no comment on the lawsuits (other than to say it hasn't been served with either suit yet). The only comment Cannizzaro's office has made is that the practice predates his tenure, as if that somehow excuses the ethical and (possibly) legal boundaries his office crossed. As a deflection, it's horrible. It's like claiming you still approve general warrants because your British predecessors did.

I'm sure DA Cannizzaro has several reasons for not immediately handing over these documents, all of them related to mitigating the damage done by these revelations. There may be a day of judicial reckoning ahead for Cannizzaro and his underlings, and the longer he can keep these documents out of the public's hands, the longer it will be until he can be confronted with the evidence.

Cannizzaro's office now has multiple opportunities to see what it feels like to be a defendant, and most likely will be the recipient of genuine subpoenas demanding compliance under the pain of actual jailing. Process servers will now have to navigate groups of protesters calling for Cannizzaro's removal just to hand him copies of these lawsuits. And all of this could have been avoided by Cannizzaro, if he had just decided against carrying on the unethical "tradition" of intimidating possible witnesses with fake subpoenas and bogus legal threats.

Filed Under: intimidation, leon cannizzaro, louisiana, new orleans parish, subpoenas, warrants, witnesses

Massachusetts State Police Promise Higher Standard For No-Knock Warrants; Immediately Break It

from the promising-change,-delivering-soundbites dept

No-knock warrants may have served a purpose when they first became a thing. It's not as though law enforcement's fear of evidence disappearing or a violent reaction to warrant service is completely unjustified. But no-knock warrants are being deployed extremely frequently, becoming the preferred method of warrant service any time drug sales are involved. The warrant requests are supposed to be subjected to a higher standard of review, but it's devolved to the point where officers are requesting no-knock warrants simply because the residence they're searching has locking doors and working toilets.

Now, cops and citizens are being killed or injured unnecessarily, simply because the SWAT team's armored personnel carrier seems like a waste of money if it's not deployed every six weeks or so. The higher standard is practically nonexistent, replaced by "upon information and belief" statements that work backwards from the desired form of warrant service.

Over in Massachusetts, state police pledged to hold themselves to a higher no-knock warrant standard after a botched raid of the wrong residence led to a civil rights lawsuit. The department said it would bring its no-knock requests directly to a judge, rather than whatever court clerk happened to be on hand when the request was made.

One year later, the state police appear to have made no changes at all, according to the Worcester Telegram's investigation.

[A] T&G review of no-knock warrants in all 10 courts in Worcester County shows that of the 10 no-knock warrants issued to state police since 2016, only one was reviewed by a judge.

Brendan T. Keenan, first assistant clerk-magistrate in Worcester’s Central District Court, said last week he was never asked to accommodate the change.

“I read that in the paper,” he said of the pledge. “That’s the only place I heard it.”

Clerk-magistrates in Fitchburg and Leominster, the only other two courts that have issued no-knock warrants to state police since 2016, said they also had never been asked to kick the warrants up to a judge.

The higher standard the police promised ended up being no standard at all. And no standard at all is standard practice for many law enforcement agencies. The only defense offered for the department's reneging on its judicial review standard is… well, it's terrible. Apparently, going in-house is just as stringent as placing a no-knock warrant app in the hands of an impartial judge.

“There is a heightened sense of review on these types of warrants now,” Col. McKeon said April 15, noting all warrants are forwarded to the district attorney’s office for review.

There are very few prosecutors willing to turn down law enforcement requests. If anyone thinks a review by the DA's office is somehow more stringent than a clerk-magistrate's cursory glance, they probably work in a law enforcement agency's PR department.

Clerks may have the word "magistrate" appended to their titles, but don't let that fool you into thinking they're only a small step down from actual judges.

Nine of the 10 no-knock warrants examined by the T&G were signed by assistant clerk-magistrates; in six of the cases, that person had no law degree.

A former judge with 16 years of experience says he knows why cops are bringing no-knock warrants to clerks: because judges will give warrant requests more scrutiny.

"This is the day-to-day bread and water of judges,” said Mr. Borenstein, adding that it is not unusual for police to eschew judicial review.

“There have been major studies done over the years, and one consistent thing about the studies is that police like to avoid judges,” he said. “They’d rather go to magistrates.”

The police maintain the promise they broke still makes the entire process perfectly legal. As they see it -- in unofficial statements made in response to the investigation -- going to clerks gives officers more flexibility. The lack of judicial rigor is supposedly offset by the list of internal policy requirements cops must follow when obtaining no-knock warrants, which includes performing zero due diligence before asking a clerk for their autograph.

There are no requirements that police conduct surveillance on a home or determine whether children live there prior to serving a no-knock warrant.

And in two of the cases examined, the no-knock warrants were used to seize marijuana -- even as the state was holding a referendum to legalize personal possession and use. In other words, a drug that citizens felt could be safely legalized was treated as a threat so severe that warrant service could only be handled with a maximum amount of surprise and force.

Because of its unwillingness to voluntarily subject itself to higher standards, the Massachusetts State Police is setting itself up to be the recipient of additional civil rights and wrongful death lawsuits. It could have taken the small extra step to ensure no-knock warrants were subjected to a bit more judicial scrutiny, but obviously preferred to do things the old way. The easier way. The way that got the department sued.

That's the real "standard" of law enforcement: the bare minimum. As defenders of the practice point out in the Telegram piece, running no-knock warrants past assistant clerk-magistrates rather than judges is "legally sufficient." It's not better for cops or better for citizens. It's nothing more than ticking just enough boxes to avoid being punished by other arms of the state government.

Filed Under: massachusetts, no knock warrants, warrants

Facebook Reports More Than Half Of Gov't Demands For Content And Data Come With Gag Orders Attached

from the greater-transparency-reveals-more-secrecy dept

US government requests for Facebook data are up, according to the company's latest biennial transparency report. Total requests jumped from 23,000 to 26,000, as compared to the first six months of 2016. Overall, it's an increase of about 12,000 requests over 2015's total.

At this point, Facebook is fielding about 1,000 more requests a month as compared to 2015. While there's not a whole lot of detail in the presented data, the social media platform is now able to report something it hadn't been able to do before the passage of the USA Freedom Act. Both of the 2016 reports now show what percentage of data requests come with a gag order attached.

According to the report, more than half of the orders received in 2016 came with gag orders: 56% for the first half of the year and 50% in the second. Gag orders are standard operating procedure for National Security Letters but those only make up a small percentage of the requests Facebook receives: less than 1,000 total for all of 2016.

A majority of the requests are search warrants, which often come with limited-time gag orders. Or at least they should be limited-time. As we saw in Adobe's recent court win, search warrants appear to be arriving with indefinite gag orders when only delayed notification is justified. Facebook has been pushing back against over-broad requests and government secrecy, but its success has been limited.

Also of interest is the lack of FISA orders. For the first time since Facebook began reporting these numbers, it received no FISA orders for content or non-content data. This would seem to confirm an apparent Section 702 blockage at the FISA court. As was noted here earlier, the FISA court apparently approved zero government requests under Section 702 (internet content/non-content collections) in 2016. The last approved order of 2015 would have carried over into the first couple of months of this year, which may be why Facebook shows FISA requests in the first six months of last year, but nothing past the point of that order's expiration.

So, the government has begrudgingly agreed to a little more transparency, but is ensuring much of what's behind the numbers remains firmly in its grasp. Gag orders accompany at least half the requests the government sends out, and the number of requests continues to increase. At this point, Facebook fields a couple thousand gagged orders a month, with most, presumably, tied to sealed cases and indictments, which kind of makes a mockery of this whole "open court" system. Considering Facebook maintains control of users' accounts, communications, and data on its platform, it makes little sense to withhold notification for extended periods, if not indefinitely.

Filed Under: first amendment, free speech, gag order, government requests, nsl, surveillance, transparency, warrants
Companies: facebook

New York Appeals Court Says Facebook Can't Challenge The 381 Broad Warrants Handed To It By New York Prosecutors

from the no-standing-and-no-remedy dept

Almost four years ago, Manhattan DA Cyrus Vance's office issued 381 warrants seeking information on Facebook subscribers. The warrants arrived almost immediately after the first Snowden leaks, which quite possibly pushed Facebook towards challenging the multitude of overbroad warrants.

Once the gag order was lifted, Facebook was able to reveal the astonishing breadth of the DA's demands. Hoping to dig up info on participants in a disability fraud scheme -- one that had already resulted in the arrests of more than 100 former police officers and firemen -- the 381 warrants demanded everything Facebook had on the named accounts, including private messages, Friends lists, and a variety of non-public content.

Facebook spent the next three years fighting the warrants in New York courts. It hasn't gone particularly well. There's the issue of standing, which few courts are willing to grant to third parties seeking to protect the privacy of their subscribers and users.

The case has reached the top of the New York judicial system, and the result is a loss for both Facebook and its users. The state's top court has rejected Facebook's appeal on procedural grounds, saying the company lacks standing to challenge the warrants. According to the court, it's up to individual users to challenge the validity of the warrants, something they can only do after the warrants have been served and fulfilled.

Facebook sought to have the warrants treated as subpoenas, which would have given it a bit more standing to challenge prosecutors' demands. It pointed out the warrants used by Vance's office more resembled subpoenas, as they weren't deployed by law enforcement to perform a search of the target's residence/papers, but rather served to a third party to demand digital data. A subpoena would be challengeable by Facebook, seeing as it's both the target and the recipient.

The lower court didn't find this persuasive and neither does the New York Supreme Court. From the decision [PDF]:

[A]n SCA warrant compels a third party -- here, Facebook -- to compile and turn over digital data under its control, and the presence of a law enforcement officer is not required for service or execution of the warrant. A traditional search warrant, by comparison, authorizes law enforcement to enter, search, and seize property. These differences in execution, however, can be easily explained by the nature of the material sought. The service provider is more likely to be better equipped to access and conduct a search of its own digital information than law enforcement personnel, and the data may be stored in different locations. Thus, the framework of execution for SCA warrants ensures efficiency and minimizes intrusion into the provider's business while promoting and protecting legitimate law enforcement interests in criminal investigation.

Despite the minor similarities between SCA warrants and subpoenas, in this post-digital world, we are not convinced that SCA warrants -- which are required under the statute to obtain certain content-based information that cannot be obtained with a subpoena due to heightened privacy interests in electronic communications -- should nevertheless be treated as subpoenas.

With that argument out of the way, the court affirms the lower court's ruling: Facebook does not have standing to challenge the 381 warrants issued by prosecutors. If Facebook doesn't like it, it's welcome to take it up with its Congressional representatives.

The dissenting opinion is less kind to the majority's opinion -- and to the actions of DA Vance's office. Judge Wilson lays down this scathing description of the warrants the court says Facebook can't challenge.

The facts are these: On the basis of a single 93-page affidavit (not subsequently shown to Facebook, or to its users whose files were seized, or to the Appellate Division, or to this Court), Supreme Court issued 381 warrants. Those bulk warrants authorized the seizure of what the District Attorney tepidly describes as "specified categories of information," but which functionally amounts to 381 users' entire histories on the platform. At least several of the users were high school students who are unlikely to have themselves been suspects in the investigation.

The warrants compelled Facebook to produce not only any and all text, photos, or videos a user had shared with her limited universe of friends, but also any private messages exchanged between the user and another individual (who could have been a spouse, doctor, religious figure, or attorney), as well as information the user had chosen to no longer share with anyone, such as a previous email address, a deleted friend, or a hidden post, and information the user had never intended to share with anyone, such as her searches and location.

It also compelled Facebook to produce content shared by users who were not named in the 381 warrants, and may not even have known anyone named in the 381 warrants, but had the misfortune of posting on the timelines of those users, uploading photos of those users, or simply belonging to any one of the groups with which a named user was affiliated.

Wilson's dissent goes on to point out the end result of this "our hands are tied by a perverse combination of federal, state, and local laws" decision: Facebook will be forced to entertain even more of these overly-broad warrants. The court's decision eliminates any possible remedy for service providers.

Finally, this appeal is the only opportunity to litigate fully the rights Congress granted to Facebook. The grounds underlying at least one portion of Facebook's motion to quash are specific to Facebook, not its users, and Facebook is before us to defend not only the constitutional rights of its users (where the majority has focused its analysis), but also its own business interests.

Even if those users could realistically seek relief for their own injuries through pretrial suppression hearings or Section 1983 suits -- which the majority believes, but I dispute -- Facebook will not be a party to those actions and the hypothetical resolution of their claims would not address or remedy Facebook's injuries. The majority does not suggest an alternative means for the company to vindicate its right to be free of unusually voluminous or unduly burdensome requests.

[...]

Under the majority's decision, this Court is powerless to protect the business interests of a major company [or] return information seized from either the 381 individuals, many of whom were never suspected of wrongdoing, or the thousands of innocent individuals who communicated or simply happened to share an interest with a user named in the bulk warrants…

This is a straight-up win for DA Cy Vance's office and New York law enforcement. It does nothing for anyone else involved in the equation, including the vast majority of those swept up in the "search." As the dissent notes, only 62 of those named in the warrants ever faced criminal charges. Most of those whose information was sought were innocent bystanders who had the unforeseeable misfortune of communicating with -- or being Facebook friends of -- people caught up in an incredibly broad and far-reaching fraud investigation.

Filed Under: cyrus vance, new york supreme court, sca, stored communications act, warrants
Companies: facebook

State Appeals Court Says There's An Expectation Of Privacy In Vehicle Data Recorders

from the hands-off-the-black-box dept

An interesting decision has been reached by the Florida Appeals Court as to Fourth Amendment protections for vehicle "black boxes." The black boxes -- which are a mandatory requirement in new vehicles -- record a variety of data in the event of a crash. (h/t FourthAmendment.com)

Charles Worsham Jr. was the driver in a crash in which his passenger was killed. His vehicle was seized and impounded by police. Twelve days later, police accessed the data in the black box without obtaining a warrant. Worsham challenged the lawfulness of the warrantless search. The police maintained the black box was full of third-party records which required no warrant or consent from the vehicle's owner.

The court sees the issue differently. In a relative rarity, the state Appeals Court decides [PDF] to get out ahead of the issue, rather than wait for precedential decisions to trickle down from the federal courts. It looks at the data harvested by the black box and suggests the amount gathered will only increase in the coming years. Rather than wait until then to make a call on the Fourth Amendment merits, it draws the line now.

Citing the Supreme Court's Riley decision (which introduced a warrant requirement for cell phone searches), the court concludes the crash data contained in the black box has an expectation of privacy.

A car’s black box is analogous to other electronic storage devices for which courts have recognized a reasonable expectation of privacy. Modern technology facilitates the storage of large quantities of information on small, portable devices. The emerging trend is to require a warrant to search these devices.

[...]

Although electronic data recorders do not yet store the same quantity of information as a cell phone, nor is it of the same personal nature, the rationale for requiring a warrant to search a cell phone is informative in determining whether a warrant is necessary to search an immobilized vehicle’s data recorder. These recorders document more than what is voluntarily conveyed to the public and the information is inherently different from the tangible “mechanical” parts of a vehicle. Just as cell phones evolved to contain more and more personal information, as the electronic systems in cars have gotten more complex, the data recorders are able to record more information.

Also of importance is the difficulty of extracting the information from the black boxes.

Extracting and interpreting the information from a car’s black box is not like putting a car on a lift and examining the brakes or tires. Because the recorded data is not exposed to the public, and because the stored data is so difficult to extract and interpret, we hold there is a reasonable expectation of privacy in that information, protected by the Fourth Amendment, which required law enforcement in the absence of exigent circumstances to obtain a warrant before extracting the information from an impounded vehicle.

Not only that, but recent legislation (the Driver Privacy Act of 2015) specifically states that the contents of data recorders belong to the vehicle's owner, not the manufacturer or any other third party.

The general rule of the statute is that “[d]ata recorded or transmitted by an event data recorder . . . may not be accessed by a person other than an owner . . . of the motor vehicle in which the event data recorder is installed.”

The dissent makes some good points as well concerning the application of the Fourth Amendment to data collected by a device many people aren't aware their vehicles contain. Even if the event data recorder harvests some information not observable from outside the vehicle, the information it collects has no intrinsic value to the vehicle's owner -- at least not at this point.

The data that the government extracted from the vehicle that was owned and driven by Appellee in this case was not information for which Appellee or any other owner/driver had a reasonable expectation of privacy. The data was not personal to Appellee, was not password protected by Appellee, and was not being collected and maintained solely for the benefit of Appellee. The EDR was installed by the vehicle’s manufacturer at the behest of the National Highway Traffic Safety Administration and, as distinct from Jones, the purpose of the data collection is highway and driver safety.

However, not all event recorders are as limited to what driving information they collect. NHTSA regulations only set the baseline. They don't prevent manufacturers from adding more data collection to black boxes. Right now, the recorders are of little use to anyone outside of law enforcement or insurance agencies. Still, it's nice to see a court be proactive on the issue, rather than wait until the Fourth Amendment issue hits critical mass.

Filed Under: 4th amendment, data recorders, florida, privacy, vehicles, warrants