Important California Privacy Bill Signed Into Law: Police Need A Warrant To Look At Your Data

from the now-for-federal-reform dept

For a long time now, we've been talking about the need for ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is a truly outdated piece of law that law enforcement regularly abuse to conduct warrantless searches on your digital information. There are a number of problems with it, but the most cited one is the fact that it considers emails to be "abandoned" if they've been on a server for 180 days, and thus no warrant is needed to read those emails. That may have made sense in the mid-1980s when the law passed and the few people who used email downloaded their emails from a server to a local disk, but it makes no sense at all in the cloud era. However, actually getting ECPA reform through Congress has proven difficult, in large part because some in law enforcement really like this ability to snoop on your emails.

Thankfully, here in California, Governor Jerry Brown has just signed a new bill, for CalECPA, which protects users' digital information here in California. Just like the federal ECPA should do, CalECPA requires a warrant for access to digital records, including emails and text messages -- and the same goes for geographical location information.

This is a big win for EFF and the ACLU, who have been pushing for this law to make it through the California Assembly and then have Governor Brown sign it. Now, if only we could do something similar at the federal level...

Filed Under: calecpa, california, ecpa, ecpa reform, email, jerry brown, location info, privacy, text, warrant

DEA Impersonating Medical Board Investigators To Gain Access To Personal Health Records

from the the-constant-hassle-of-minimal-paperwork-thwarted-yet-again! dept

Medical records have long been given an increased expectation of privacy, something that dates back to before the passage of HIPAA. (See also: Hippocratic Oath.) Consultations with doctors -- and the written records resulting from them -- have generally been treated as confidential, seeing as they contain potentially embarrassing/damaging information. Personal health information can be reported to law enforcement for many reasons: suspicion of criminal activity on the health entity's property, suspicion of criminal activity related to an off-site emergency, reporting a death, patients with stabbing/gunshot wounds, or in the case of a serious/immediate threat. Otherwise, HIPAA's rules for law enforcement say personal information can only be released under the following conditions:

To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or an administrative request from a law enforcement official (the administrative request must include a written statement that the information requested is relevant and material, specific and limited in scope, and de-identified information cannot be used).

The bar is set pretty low and the DEA has been taking advantage of it. Jon Cassidy of Watchdog.org is reporting that the agency is rooting around in medical records in hopes of finding patients or health care providers who might be abusing drugs.

The Drug Enforcement Administration has been sifting through hundreds of supposedly private medical files, looking for Texas doctors and patients to prosecute without the use of warrants.

What the DEA is using instead is a blend of impersonation and administrative permission slips sporting the agency's own signature.

Instead, the agents are tricking doctors and nurses into thinking they’re with the Texas Medical Board. When that doesn’t work, they’re sending doctors subpoenas demanding medical records without court approval.

How often is this happening? Apparently it's so close to "all the time" that the DEA doesn't even have an approximate guess. This is what a DEA spokesperson told the Daily Caller.

“It’s not like there’s ten of them. There’s probably thousands — I know there are thousands,” Matt Barden, spokesman for the DEA, told the Daily Caller News Foundation about the DEA’s use of administrative subpoenas.

Early last year, a federal court in Oregon ruled the DEA could not access the state's prescription database without a warrant. Unfortunately, this was due to Oregon's state laws being more restrictive than federal law. A federal judge in Texas reached the opposite conclusion, finding that the DEA's use of administrative subpoenas complied with both HIPAA and state law. This decision is now headed for the Fifth Circuit Court of Appeals, where it is hoped a finding similar to the decision in Oregon will be the end result. But judging from the laws in place, that outcome is doubtful.

While the DEA's use of administrative subpoenas appears to comply with HIPAA's restrictions, its repeated attempts (many of them successful) to access medical records with no paperwork whatsoever seem less likely to stand up to legal scrutiny.

The Dallas-area doctors bringing the lawsuit against the DEA have uncovered plenty of DEA subterfuge. In their case, three DEA agents showed up at their offices with a state medical board investigator. Only the investigator identified herself. The agents remained silent, allowing the nurse to believe they, too, were with the state medical board.

The state medical board may have every right to view medical records without any accompanying paperwork, but that's because this information falls directly under its purview. The DEA, however, is looking to build criminal cases. This brings with it additional Fourth Amendment considerations and, at the very least, should bind it to the minimal restrictions of HIPAA. Apparently, issuing its own permission slips is still too much work and the delivered paperwork might accidentally restrict it to only certain medical records pertaining to certain people. By impersonating medical board members, agents have unrestricted access to whatever they ask for.

As Watchdog's Jon Cassidy points out, patients who'd like their privacy respected may want to seek their prescriptions and refills… elsewhere.

The DEA’s practice of avoiding warrant requirements has produced this absurdity: If you have a prescription for Adderall or OxyContin, you might be safer getting your drugs on the street than through your own doctor.

Street dealers, after all, don’t keep patient records, and they’re afforded more constitutional protections than medical practitioners. That is, cops still need a warrant to search them.

While the latter isn't strictly true in all cases, it's true enough to show how limited the protections of HIPAA actually are. The more disturbing aspect is that the DEA isn't even satisfied with near-instant access to a wealth of medical records provided by administrative subpoenas. It apparently only uses the correct paperwork as Plan B, preferring to mislead medical practitioners by allowing them to believe its agents are investigators working for the state medical board.

Filed Under: 4th amendment, dea, health records, hipaa, impersonation, investigations, medical boards, privacy, warrant

4th Amendment Lives: Court Tells US Government Get A Warrant If It Wants Mobile Phone Location Info

from the look-at-that dept

A potentially big ruling came out of the courtroom of Judge Lucy Koh yesterday, in which she affirmed a magistrate judge's decision to tell the government to get a warrant if it wants to obtain historical location info about certain "target" mobile phones (officially known as "Cell Site Location Info" -- or CSLI). The government sought to use a provision of the Stored Communications Act (a part of ECPA, the Electronic Communications Privacy Act) to demand this info without a warrant -- using a much lower standard: "specific and articulable facts" rather than the all important "probable cause." Judge Koh says that's doesn't pass 4th Amendment muster, relying heavily on the important Supreme Court rulings in the Jones case, involving attaching a GPS device to a car, and the Riley case about searching mobile phones.

Based on the preceding U.S. Supreme Court cases, the following principles are manifest: (1) an individual’s expectation of privacy is at its pinnacle when government surveillance intrudes on the home; (2) long-term electronic surveillance by the government implicates an individual’s expectation of privacy; and (3) location data generated by cell phones, which are ubiquitous in this day and age, can reveal a wealth of private information about an individual. Applying those principles to the information sought here by the government, the Court finds that individuals have an expectation of privacy in the historical CSLI associated with their cell phones, and that such an expectation is one that society is willing to recognize as reasonable.

This is big. Obviously, the government is likely to appeal, and so as a first pass, this might seem meaningless. We've still got an appeals court (and possibly a rehearing) and a Supreme Court to get to, but as a first ruling, it's a good one. Koh's analysis is pretty thorough. It notes the similarities to both the Jones and Riley cases:

Here, as in Jones, the government seeks permission to track the movement of individuals—without a warrant—over an extended period of time and by electronic means. CSLI, like GPS, can provide the government with a “comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations.” Riley, 134 S. Ct. at 2490 (quoting Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring)). With the proliferation of smaller and smaller base stations such as microcells, picocells, and femtocells—which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home, ...—the government is able to use historical CSLI to track an individual’s past whereabouts with ever increasing precision. See Riley, 134 S. Ct. at 2490 (explaining that a cell phone’s “[h]istoric location information . . . can reconstruct someone’s specific movements down to the minute, not only around town but also within a particular building”). At oral argument, the government agreed that in some instances CSLI could locate an individual within her home, ... and did not dispute that CSLI will become more precise as the number of cell towers continues to multiply.... This admission is of constitutional significance because rules adopted under the Fourth Amendment “must take account of more sophisticated systems that are already in use or in development.”...

In fact, the information the government seeks here is arguably more invasive of an individual’s expectation of privacy than the GPS device attached to the defendant’s car in Jones. This is so for two reasons. First, as the government conceded at the hearing, over the course of sixty days an individual will invariably enter constitutionally protected areas, such as private residences.... Tracking a person’s movements inside the home matters for Fourth Amendment purposes because “private residences are places in which the individual normally expects privacy free of governmental intrusion not authorized by a warrant, and that expectation is plainly one that society is prepared to recognize as justifiable.” Karo, 468 U.S. at 714; see also Kyllo, 533 U.S. at 31 (“At the very core of the Fourth Amendment stands the right of a man to retreat into his own home and there be free from unreasonable governmental intrusion.” (internal quotation marks omitted)). As one court put it, “Because cellular telephone users tend to keep their phone on their person or very close by, placing a particular cellular telephone within a home is essentially the corollary of locating the user within the home.” ....

Second, the government conceded at oral argument that, compared to GPS tracking of a car, the government will “get more information, more data points, on the cell phone” via historical CSLI... (“But, yes, of course the person has the phone more than they have their car, most people at least do, so it gives [the government] more data.”). Cell phones generate far more location data because, unlike the vehicle in Jones, cell phones typically accompany the user wherever she goes.... Indeed, according to a survey cited by the U.S. Supreme Court in Riley, “nearly three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting that they even use their phones in the shower.”....

Judge Koh points to some survey data from Pew (sent in by EFF) noting that many, many people consider their location information to be "sensitive information" and, on top of that, the fact that CSLI is generated even if someone turns off the GPS or "location data" features on their phone -- meaning they can't even opt out of generating such information to try to keep it private.

More importantly, Judge Koh takes on the issue of the infamous third party doctrine and the awful Smith v. Maryland precedent, which says you have no expectation of privacy in data held by third parties. To date, the Supreme Court has punted on this issue in the Jones and Riley cases. However, Koh addresses the issue head on, and says the third party doctrine should not apply to phone location data like this. The key issue: in the Smith case, the "information" that was given to the third party was the phone number being dialed. This was information that the caller voluntarily conveyed to the phone company in order to make the call. Judge Koh points out that this information is quite different:

Cell phone users, by contrast, do not “voluntarily convey” their location to the cellular service provider in the manner contemplated by Miller and Smith. This is especially true when historical CSLI is generated just because the cell phone is on, such as when cell phone apps are sending and receiving data in the background or when the cell phone is “pinging” a nearby cell tower. As the government’s FBI special agent explained, “CSLI for a cellular telephone may still be generated in the absence of user interaction with a cellular telephone.” .... “For example,” the special agent continued, CSLI may be generated by “applications that continually run in the background that send and receive data (e.g. email applications).” ... At oral argument, the government confirmed that its § 2703(d) application authorizes the government to obtain historical CSLI generated by such activities.

[....] In so doing, a cell phone periodically identifies itself to the closest cell tower—not necessarily the closest cell tower geographically, but the one with the strongest radio signal—as it moves through its network’s coverage area.... This process, known as “registration” or “pinging,” facilitates the making and receiving of calls, the sending and receiving of text messages, and the sending and receiving of cell phone data.... Pinging nearby cell towers is automatic and occurs whenever the phone is on, without the user’s input or control.... This sort of pinging happens every seven to nine minutes....

In Miller and Smith, the individual knew with certainty the information that was being conveyed and the third party to which the conveyance was made. Cell phone users, on the other hand, enjoy far less certainty with respect to CSLI. CSLI, in contrast to deposit slips or digits on a telephone, is neither tangible nor visible to a cell phone user. When the telephone user in Smith received his monthly bill from the phone company, the numbers he dialed would appear.... The CSLI generated by a user’s cell phone makes no such appearance.... Rather, because CSLI is generated automatically whenever a cell tower detects radio waves from a cell phone, a cell phone user typically does not know that her phone is communicating with a cell tower, much less the specific cell tower with which her phone is communicating.... It may be, as the government explained, that a cell phone connects to “many towers” during the length of a call,... and the tower to which a cell phone connects is not necessarily the closest one geographically.... Moreover, when an app on the user’s phone is continually running in the background, ... she may not be aware that the cell phone in her pocket is generating CSLI in the first place.

And thus, even with the third party doctrine, this information is quite different than that discussed in the Smith v. Maryland case, which involved phone numbers dialed:

In light of the foregoing, the Court concludes that historical CSLI generated via continuously operating apps or automatic pinging does not amount to a voluntary conveyance of the user’s location twenty-four hours a day for sixty days. Such data, it is clear, may be generated with far less intent, awareness, or affirmative conduct on the part of the user than what was at issue in Miller and Smith. Unlike the depositor in Miller who affirmatively conveyed checks and deposit slips to the bank, or the telephone user in Smith who affirmatively dialed the numbers recorded by the pen register, a cell phone user may generate historical CSLI simply because her phone is on and without committing any affirmative act or knowledge that CSLI is being generated. Smith, for example, never contemplated the disclosure of information while the landline telephone was not even in use.

This sort of passive generation of CSLI does not amount to a voluntary conveyance under the third-party doctrine.

Judge Koh notes that this ruling isn't rejecting the ruling in Smith -- rightly noting that only the Supreme Court can determine that it's no longer good law -- but notes that the ruling there is different enough from this one that it does not apply. Ideally, the Supreme Court will get around to rejecting the ridiculous third party doctrine altogether, but if it must stand, a ruling like this is helpful in returning just a bit of 4th Amendment protected privacy to the American public.

Filed Under: 4th amendment, csli, ecpa, location information, lucy koh, privacy, probable cause, sca, warrant
Companies: aclu, eff

White House Vaguely Agrees Outdated ECPA Should Be Reformed But Only With An Eye On The Government's 'Interests'

from the SOMEONE-SHOULD-REALLY-FIX-THAT-SOMETIME dept

The Obama administration must be doing a little housecleaning in preparation for the 2016 winner. After months of highly-sporadic and belated responses to We The People petitions, it's answered two big ones (that have been sitting around forever) in a single day. It's also issued a handful of other responses to open petitions, some of which are little more than "we decline to respond," accompanied by a link to the site's Terms of Participation.

It took on two big petitions today. The first was a response to a request to pardon Snowden, which it denied under its "No Good Whistleblowing Goes Unpunished" policy. The second asked for a long-delayed rewrite of an outdated law.

The Electronic Communications Privacy Act has been in need of reform for years. If nothing else, the law's misleading name needs to be changed. One of the more notorious aspects of the law is that it gives email less privacy protection than snail mail, which is already an exceedingly low bar.

The administration agrees that reform of this law -- which treats email older than six months as "abandoned" and thus easily-accessible by law enforcement -- is needed. However, it does so both belatedly, vaguely and disingenuously.

The We The People petition calling for ECPA reform was posted November, 12, 2013. It passed the 100,000-signature threshold roughly 30 days later. At that point, a response was "required." 593 days later, that response has finally arrived.

It's obvious that many -- and arguably, most -- Americans today use email as one of their primary means of communication. Particularly in an era where we keep so much of our lives online, the content housed there deserves strong privacy protections -- which is at the core of what ECPA was designed to do. But over time, technology has evolved.

Which is why our policy teams agree with you: ECPA is outdated, and it should be reformed.

This is good news. Or it would be if there were any particular plan to get something done. While the response agrees that the outdated law's take on email privacy protection is pretty much terrible, the administration doesn't seem too willing to push for any specific reform effort.

We know there are still important details being worked out across government and in the halls of Congress. We aren't going to endorse a single ECPA-reform bill at this time. As any given bill goes through committee and makes its way to the House and Senate floors, the draft is negotiated and modified to address concerns and strengthen the bill.

In other words, we like the idea of reform so much we're going to do nothing about it. While efforts have been made over the past few years, they've been stalled/gutted to appease law enforcement and (yes, really) regulatory agencies' interests. Very little forward motion has been made and without something stronger than "we'll probably support whatever actually makes its way to the President's desk" propelling this reform, it could still be several more years before the already-outdated law is rewritten to properly address a communication method that originated nearly 45 years ago.

Finally, the response sends a mixed message about reform in the very last sentence.

That said, we're encouraged by the strong bipartisan support for updating this legislation in both chambers of Congress, and are looking forward to seeing this law address today's technological realities while preserving the interests we must protect.

This seems to indicate it will be more supportive of a bill that has the backing law enforcement and other government agencies. A warrant requirement for emails older than six months isn't that much of an imposition, but so far, it's been a tough idea to sell. This last sentence shows the administration finds the government's "interests" worth protection. The privacy interests of millions of Americans? Not so much.

Filed Under: 4th amendment, ecpa, ecpa reform, email, obama administration, privacy, warrant, we the people

Google Denies Narrow Warrant Request For Emails; Government Responds By Asking For Everything Ever

from the Plan-B-for-'British' dept

Another participant in the Magistrate's Revolt appears out of the unlikeliest of districts: Alaska. The court order, first pointed out by ACLU's chief tech sorcerer, Chris Soghoian, features Judge Kevin McCoy telling the government to take its overly-broad search warrants and hit the road. Well, mostly. The order is without prejudice, which means the government still has options available, but from what's stated by the judge, it won't be the latest option the government deployed.

The case details are a bit thin. With the exception of this court order, the rest of the documents are under seal. It deals with an investigation of Craigslist ads allegedly soliciting sexual contact with minors. The ad was reported to authorities by a Craigslist user. Law enforcement officials detained the person who placed the ad, who then admitted to being in possession of child porn, as well as being interested in sexual relations with children.

With the perp nailed down, law enforcement went after those who answered the ad. A subpoena turned up six Gmail addresses, as well as the dates and frequency of contact with the email address linked to the offending ad.

Four of the six email addresses obtained received either a single response or no response from the Craigslist poster, suggesting a lack of ongoing negotiations for the sexual services of a minor. The other two, however, received multiple responses, suggesting negotiations had moved ahead.

Law enforcement then sought to obtain the content of the messages to the Yahoo email address of the detained suspect. That's where it ran into trouble. Rather than narrow its demands to the two accounts with the most activity, it requested content from all ad respondents. It did, however, specify a date range specifically surrounding the posting of the ad. This was approved by a magistrate judge and served to Google.

Google turned the warrant down, citing technical difficulties..

We have received your Search Warrant and after evaluating the items to be seized, we have determined that Google is not capable of identifying the specific records responsive to your request as currently described in the warrant. Because our production must adhere to the stated limits of the warrant, and we are unable to do so in this case, we require amended or re-issued process.

That's when things started to go a bit sideways.

Rather than seek an order compelling Google to comply with the original warrant, the government presented the Court with a second application. The agent explained that “Google was unable to comply with the warrant as written because the time frame was too narrow,” “Google is unable or unwilling to parse individual accounts for” the specific emails, and “Google typically provide[s] broad ranges of information and place[s] the burden on the law enforcement officer searching the information to stay within the parameters of the warrant.”

Perhaps Google was bluffing or it was simply tired of "providing broad ranges of information" to every government agency that came knocking. Whatever the case, the government's next move suggests it was stunned by Google's (apparently out-of-character) refusal… or its somewhat unbelievable claim that "records" from that time period simply could not be located. The government already had a judge clear the previous warrant application and give it the Fourth Amendment thumbs-up. It would have been incredibly simple to approach the same judge for a court order compelling the release of the records. What it did instead was strip the Fourth Amendment-friendly language from the previous application and present it to a different magistrate judge.

[T]he government’s second warrant requests authorization to seize the six third-party Gmail accounts in their entirety. Once the contents of the accounts are in its possession, the government appears to promise not to look at any emails outside the applicable date ranges. However, the warrant would not limit its ability to search the entirety of the Gmail accounts as the proposed warrant plainly authorizes the inspection of all email content in the accounts without regard to how remote in time or unrelated that content is to the current investigation.

So, to "fix" a Fourth Amendment-compliant warrant -- one that sought specific emails from a very narrow time frame -- the government went the other way, basically saying, "The hell with it. Give us EVERYTHING." Judge McCoy seems somewhat astounded by the government's Plan B: a 90% breathtaking audacity/10% vindictiveness warrant app that came nowhere near even the most minimal of Fourth Amendment standards.

Based on these probable-cause conclusions, a narrow intrusion into the email accounts is warranted. But the present application goes well beyond the narrow intrusion justified by the probable cause showing. It seeks judicial authorization to seize and then search the entire content of the six third-party Gmail accounts with no justification other than that Google has unilaterally elected not to comply.

In less subtle terms, the government behaved like a child when it was told, "No." Judge McCoy's order tells the government to grow up.

[T]he Court reiterates that the government has two alternative avenues through which to seize and search the sought-after emails. First, the government remains free to seek an order compelling Google to comply with the earlier warrant provided it limits the request to email content for the narrowly defined periods relevant to the investigation of the six third-party Gmail accounts. Alternatively, the government can renew the instant application provided it proffers to seal, without any review absent further court order, material supplied by Google that is outside the time period for which probable cause has been established.

Do it right or don't do it at all. At the very least, don't swing from one end of the Fourth Amendment spectrum to the next just because the warrant recipient doesn't immediately comply. Turning a narrow warrant into a general warrant is no way to run a law enforcement agency. And stomping all over the rights of others just because you're pissed off at being refused is no way to treat the people who pay your salaries.

Filed Under: doj, emails, warrant
Companies: google

Child Porn Charges Dropped Because Investigators Cut-And-Paste Wrong Info Into Warrant Requests

from the simple-errors-cause-bigger-headaches dept

This could have happened to any civilian, but it happened to a sheriff's deputy. While investigating a former Danes County (WI) deputy for sexual assault charges related to his inappropriate relationship with a convict (state law makes this a sexual assault crime even if consensual, because of the supervisory role deputies have), investigators came across child porn images stored on his computer.

The detectives acquired two warrants: one to search Deputy Jeffrey Hilgers' home for evidence of his relationship with the inmate (now out on probation) and one to search his computer for more child porn. But they screwed up. The end result: all seven child pornography charges have been dropped.

Child pornography possession charges against a former Dane County sheriff’s deputy were dismissed Wednesday after a judge ruled that there was a fatal cut-and-paste error on a search warrant that led to the discovery of the illegal images on the deputy’s computers.

Dane County Circuit Judge John Markson ruled that in fashioning a search warrant for the home of former deputy Jeffrey C. Hilgers, 43, investigators inadvertently used a paragraph which stated that they were seeking child pornography, and not one specifying a search for evidence of an illicit relationship between Hilgers and a woman who was serving a jail sentence at home on electronic monitoring.

Hilgers is still possibly on the hook for second-degree sexual assault charges, but everything related to the child porn discovered in his possession has been vanished away. The judge called the error "insurmountable." Details matter, and it makes no difference that it was someone in law enforcement facing these charges. The judge recognized that it was the sort of error anyone could make.

“I do think that likely what happened was a result of cutting and pasting by using a warrant from a different case that involved child pornography,” Markson said, agreeing with an explanation for the error provided earlier by Deputy District Attorney Michelle Viste.

Anyone could have made this mistake, but that doesn't excuse it. People are wrongly jailed due to procedural errors. And people walk away from criminal charges for the same thing. Our nation's law enforcement officers wield a considerable amount of power -- especially when coupled with government prosecutors. But this power must be constrained if justice is the desired outcome. Not every warrant is its own special snowflake, but if prosecutors want the acquired evidence to hold up in court, they need to be sure those below them have been diligent in their work.

A second-degree assault charge is all that remains -- something that seems extremely odd considering the former deputy and former inmate are now married. (For now...) But the more damning charges no longer exist because someone decided to boilerplate the warrant app using wording borrowed from another case. Warrants may be largely similar but each case is unique, and if the words "probable cause" are going to be worth anything, unfortunate situations like these need to happen. Otherwise, every warrant will become boilerplate and the "probable cause" used to justify the search will be nothing more than taking the (sworn) words out of someone else's mouth and using someone else's alleged misdeeds to justify the search of another person's property.

Filed Under: 4th amendment, cut and paste, dane county, jeffrey hilgers, mistakes, warrant

FBI's 'We're From The Cable Company' Ruse Not Convincing To Magistrate Judge

from the we-can't-fix-the-problem-but-we-can-look-through-all-your-stuff dept

The FBI's decision to impersonate repair technicians in order to perform a warrantless search is backfiring. Last July, FBI agents investigating an illegal gambling operation worked with Caesars Palace Casino to cut the internet connection to three villas it believed were the operation's ad hoc headquarters. It then sent agents disguised as repairmen to "fix" the problem. Once inside, these agents took photos, recorded video and otherwise observed what they believed to be an illegal bookmaking operation.

Shortly after this warrantless search, the FBI decided it was time to get a search warrant. In its warrant request, it conveniently left out the part where it cut the DSL connection and sent in agents dressed as repairmen. Because of this "fatally flawed" application, a Nevada magistrate judge is recommending the federal district court toss the warrant and suppress the evidence. [Decision pdf link]

Magistrate Judge Peggy Leen ruled that the failure to mention that the original case was born from the "ruse" meant the judge who signed a search warrant this summer didn't have all of the facts. Nowhere in the search warrant request, however, did the authorities mention that they allegedly saw illegal wagering on computers after posing as technicians who in reality briefly disconnected the DSL.

"The investigators' suspicions that Phua was engaged in illegal sports betting at Caesars Palace may be borne out by the evidence recovered in the execution of the warrant," Magistrate Judge Peggy Leen ruled "However, a search warrant is never validated by what its execution recovers."

The material omission of the probable cause's origin (a warrantless search using agents posing as repairmen) should have been enough to get this warrant tossed. The FBI, of course, claimed it omitted this information because it was "law enforcement sensitive." One would think a magistrate judge should have access to sensitive material because it's part of the "law enforcement" field, but the FBI apparently felt otherwise.

Beyond that, there were several flaws in the application -- flaws Judge Leen says weren't intentional but "reckless." The FBI skewed the minimal amount of information it had collected from its illegal entry to make it seem as though it had actually acquired much more damning evidence.

The affidavit was written in a way to suggest investigators had much more information linking Phua to an illegal sports betting operation or wire room connected with the occupants of villa 8888. The affidavit’s repeated use of the phrase “Phua’s and his associates” or “Phua’s associates” or “at the behest of Phua or one of his associates” suggests that Phua was making requests and engaging in conduct which he was not.

And that's only one small part of the affidavit. According to Judge Leen, nearly everything the FBI stated in support of its warrant request completely misrepresented what was actually happening at the Caesar's Palace villas. (Keep the following in mind the next time you visit Las Vegas. In an FBI agent's vivid imagination, your normal, lawful gambling can easily acquire very sinister connotations.)

The application failed to disclose to the issuing magistrate judge that Wood and SA Lopez defied the butler’s instruction to remain in the butler’s pantry and entered the villa in violation of the Fourth Amendment. The application also falsely stated that Wood was fearful for his safety and was too afraid to accompany SA Lopez on a subsequent entry into villa 8882. A video of Wood’s interaction with the butler taken on July 4, 2014, and produced by the government in discovery reveals this claim is false.

[...]

The affidavit falsely stated that an unidentified “associates” of Paul Phua reserved all three villas and that the residents of the villas arrived close in time to each other. In fact, the principal resident of villa 8888, Hui Tang, made his own arrangements with Caesars and arrived several days later than the warrant application claims…

[...]

The application is grossly misleading in claiming that eight separate internet lines were installed, and by omitting the fact that the only unusual amount of computer equipment was in villa 8888 and was installed at the request of that villa’s occupants. Caesars installed a single line in each of the six villas in the building, including three villas whose occupants were unrelated to this case.

[...]

The agents were working with Caesars’ DSL contractor, Wood TMS, and knew by July 4, 2014, that Caesars had decided to install DSL internet service in each villa as an alternative means of internet access because of pervasive problems with the internet service provided by Cox Communications. The installation of a single DSL line in 8882 did not signify any unusually large amount of internet traffic, and there was no evidence that the residents of 8882 made any unusual requests for equipment or technical support.

[...]

The affidavit described deposits to Caesars and transactions between Phua and his associates through Caesars which grossly distorted the nature of those transactions…[T]here is nothing suspicious about gamblers transferring money to their casino accounts. “Front money” deposits are common, and the casino frequently requires a deposit to extend credit. The application omitted references to these facts and attempted to characterize the deposits as suspicious.

[...]

The application represents that Phua transferred $3 million to Gyouye Huang. Huang was a guest in villa 8882. Caesars’ record actually indicates “signed marker MKR for $3Mil trans to 4266598 [Huang Caesars player number] Chen Husan per MG/Bing.” The search warrant application omitted reference to the fact that that it is common for gamblers to share credit lines and that specific individuals involved in this investigation had done so in prior years on prior gambling trips. Even assuming the agents were “confused,” confusion is not probable cause, and the credit line was not fairly characterized to the issuing magistrate judge.

And then there's the testimony of Special Agent Minh Pham, which contains an interesting statement caught by Marcy Wheeler of Emptywheel.

After Pham submitted and obtained the search warrant, he learned the affidavit contained errors. Specifically, it stated that Paul Phua wired $4 million into a Caesars account to secure a credit line. Pham later discovered it was actually Seng Chen “Richard” Yong that requested the wire to secure both their lines of credit. However, at the time Pham submitted the search warrant affidavit, he believed it was correct that Paul Phua had initiated this transfer.

The affidavit also stated Paul Phua had transferred approximately $900,000 from a casino in Fort Lauderdale, Florida, to the Caesars account. However, Pham later learned that Paul Phua had been only one of the individuals who signed the consent to have that money wire-transferred into Yong’s account. At the time Pham submitted the affidavit, he believed the statement was true based on documents from Caesars concerning monetary transfers that he had received. Pham referred to the spreadsheet contained in government’s Exhibit 2F as a document he relied upon to support his statement in the affidavit. The font size was very small and difficult to read.

He also discovered another error in the affidavit days later. There were transfers for $3 million between individuals in the villas. He looked at the spreadsheet, and it was off by one or two lines,” which caused him to associate the wrong name with the transfer.

As Wheeler notes, the FBI seems to have a malleable baseline when it comes to font sizes. What Caesars turned over voluntarily was "very small and difficult to read." But the agents used it without demanding something more legible. Compare that to the high-profile government takedown of encrypted email developer Ladar Levison.

You’ll recall that when the FBI went after Lavabit to get its crypto key, Lavar Levison tried to comply by providing a printout of the key. But the government complained it was illegible, and got Levison held in contempt.

So, Levison's 4-point printout of his encryption key was too small for the FBI, which complained to the court until it got its way. In this case, a "too small" printout was used without complaint, ultimately resulting in several flawed assertions being made in a warrant affidavit. "Too small" must be another part of the FBI's double standards -- one that makes concessions to third parties more amenable to the agency's aims.

A district court judge will make the final decision as to whether this warrant remains tossed. The saddest part about this is that the FBI gave itself an (illegal) head start and still managed to hand in a warrant request loaded with bad detective work and worse conjecture.

Filed Under: 4th amendment, cable company, cutting internet access, doj, fbi, hotel, paul phua, peggy leen, warrant
Companies: caesers

Shameful: Feds Spied On Wikileaks' Journalists' Emails

from the freedom-of-the-press? dept

The DOJ's war on investigative journalism keeps on going. In 2013, it came out that the DOJ was able to get massive phone records of AP journalists in trying to find the source of a leak. Soon after that, it obtained Fox News reporter James Rosen's emails by lying to a court and saying he was a co-conspirator with a State Department official who leaked him some information. And, now the latest example, is that it's come out that the feds demanded and received emails and other information from three Wikileaks staffers who had Google Gmail accounts. And, because this is what the government does, with the orders for that information, Google was slapped with a gag order that prevented the company from informing those staffers.

It's no secret that the DOJ has been desperate for years to come up with some way -- any way -- to try to charge Julian Assange with crimes under the Espionage Act. However, to date, this has failed. Attempts to pressure Chelsea Manning into lying about deeper involvement from Wikileaks failed, and that should have been the end of any investigation. But years later, the "investigation" continues for no clear reason. If the DOJ has been unable to find any evidence of criminal violations so many years later, it should end the investigation.

Instead, it's spying on journalists' emails, using a combination of the outdated ECPA (Electronic Communications Privacy Act) and the Espionage Act to demand a very broad set of information from Google concerning those three staffers. Of course, the DOJ and Wikileaks haters will counter that Wikileaks isn't a journalistic operation, but that is hard to square with reality. You would have a very difficult time coming up with a legitimate distinction for how what Wikileaks does is any different than what the NY Times or Washington Post investigative reporters do on a regular basis. Getting leaked documents is part of investigative reporting. Cultivating sources is part of investigative reporting (and that likely happens a lot more often with traditional reporters than operations like Wikileaks).

Trevor Timm has an article highlighting how these warrants to seize Wikileaks' staffers' emails is an outright attack on journalism, even as many traditional journalism operations refuse to speak out against the treatment of Wikileaks:

Unfortunately the news world has never rallied around WikiLeaks’ First Amendment rights they way they should – sometimes even refusing to acknowledge they are a journalism organization, perhaps because they dare to do things a little differently than the mainstream media, or because WikiLeaks tweets provocative political opinions, or because they think its founder, Julian Assange, is an unsympathetic figure.

Those are all disgraceful excuses to ignore the government’s overreach: the rights of news organizations everywhere are under just as much threat whether the government reads the private emails of staffers at WikiLeaks, Fox News or the Associated Press. In the eyes of the law, the organizations are virtually indistinguishable, as legal scholars from across the political spectrum have documented for years.

Isn't it about time "we don't like those people" stopped being an acceptable excuse for spying on people? Wasn't our Constitution supposed to prevent that kind of abuse?

Filed Under: doj, grand jury, investigation, julian assange, seizure, warrant, wikileaks
Companies: google, wikileaks

Baltimore PD Hides Its Stingray Usage Under A Pen Register Order; Argues There's Really No Difference Between The Two

from the yeah-but-no-not-even-close dept

Another case involving Stingray devices has made its way into the federal court system, prompting the ACLU to join the battle on behalf of the defendant. A murder-for-hire sting conducted by the Baltimore police and the FBI involved the use of a Stingray device, but the paperwork used to justify the deployment says nothing about an IMSI catcher. The order obtained by the Baltimore PD is for a pen register/trap and trace device. [pdf link]

Uncharacteristically, the Baltimore PD disclosed its use of a Stingray device to locate a suspect's phone during court proceedings. Even more uncharacteristically, the government is fighting to keep the evidence from being suppressed, rather than opting to protect its means and methods at the expense of collected evidence.

How the evidence was obtained matters, even though the government's lawyers are arguing that it doesn't.

The government said the court order obtained by authorities, called a pen register, covers the technology because it refers to cellular tracking device and GPS location information.

But the ACLU argues that the state's statute for such pen register orders "makes no provision for, or even mention of, a 'cellular tracking device' " and is commonly understood to only include the "trapping" of call log information.

"In addition, there is absolutely no indication in the application or the order that the authorization will subject potentially unlimited numbers of innocent third parties to dragnet surveillance, none of whom will ever receive notice that their phones were tracked and that the search will intrude into constitutionally protected spaces," the ACLU wrote.

The government argues that no Fourth Amendment violations occurred, even if the court order said nothing about the device used to locate the phone. It asserts that everything was legit, and even if it wasn't, it was an honest mistake and it would have just found the suspect and his phone sooner or later -- perhaps even by using the method it actually requested. [pdf link]

[T]he Government argues that the search was not in violation of the Fourth Amendment for three reasons: (1) the search was authorized by the February 5, 2014, Order (the “Order”), which was a valid warrant; (2) even if the warrant was deficient, law enforcement acted in good faith reliance on it; and (3) even without a warrant, the evidence obtained would not be subject to exclusion because the inevitable discovery doctrine applies.

Wrong, wrong and wrong, according to the defendant's (Robert Harrison) counsel.

The Order was not a valid warrant for at least three reasons. First, the Application in support of the Order was purposefully misleading. The Government crafted the Application as if it were a routine application for a pen register or a trap and trace device, citing the applicable Maryland statutory authorization. It did not mention the term “cell site simulator,” nor did it describe the novel technology in a manner that the judge would understand its intrusiveness on the privacy rights of Harrison or others. Second, although the Government now seeks to treat the Order as a warrant, it failed to comply with the statutory temporal requirements for the execution of warrants, which impacts probable cause. Third, the Order fails the particularity requirement because it specified that it was authorizing a search of only the target phone, but, instead, the cell site simulator searched the phones of infinite third parties in the vicinity. As such, if it was a warrant, it was an illegal general warrant.

The "good faith" exception -- the benefit of a doubt the government frequently extends to itself -- is also addressed.

Further, the Government cannot rely on the good faith exception or the inevitable discovery doctrine. The good faith exception cannot apply here because the purported warrant was facially invalid, and the affiant knowingly or recklessly misled the magistrate with material omissions concerning the cell site simulator. The inevitable discovery doctrine likewise does not apply because the Government’s argument is predicated on an alternative plan that is latent with speculation and conjecture, instead of historically verifiable facts.

Going beyond this, the government attempts to claim the Pen Register order is no different than an actual search warrant -- something it didn't have in its possession when it used the cell site spoofer to "search" Harrison's premises (as well as anyone else's within range) for the cell phone. The filing points out that the statute under which the order was obtained doesn't provide for the issuance of warrants. Even if the government wanted to treat the order like a warrant, it was missing all sorts of specifics crucial to search warrants -- like the particularity of the search, time limitations and probable cause findings.

Not only that, but by obtaining a Pen Register order rather than a search warrant, the government deliberately hid its methods from the courts. The particulars of the technology being deployed were never presented to the magistrate. All of this adds up to one thing: even if the government wants to pretend the order was a warrant, at the very best, it was in possession of a general warrant -- the sort of thing that the Fourth Amendment is in place to safeguard against.

The government also blew past temporal limits normally found in warrants. In its arguments, it wants to have it both ways -- the leniency of the 60-day window provided for Pen Register orders and the powers granted to those in possession of actual search warrants, which are only good for 15 days after issuance. The deployment of the Stingray didn't occur until 50 days after the Pen Register order was obtained.

Addtionally, the phone sought by the FBI and Baltimore PD was no longer in possession of the sting target by the time it went "searching" for it. Within a day of obtaining the Pen Register order, the phone was answered by an unknown male, who told the informant that the suspect (Smith) would call him back on his personal phone. Further records submitted as evidence note that every call between Smith and informants occurred on personal phones, rather than the phone the government was looking for. As the filing points out, had the government sought a warrant to locate this phone, it would have been unable to provide probable cause findings. As things stood nearly a month after the Pen Register order was obtained, the government didn't know much about who actually had the phone, much less whether the phone was still being used as part of the murder-for-hire plot.

By covering up its use of a Stingray device, the government availed itself of the less stringent standards inherent to Pen Register orders. But when it comes to defending itself against complaints of Fourth Amendment violations, the government attempts to portray the order as indistinguishable from a search warrant -- except for all the stuff it's supposed to do on its end to ensure rights aren't violated.

Filed Under: 4th amendment, baltimore, imsi catcher, pen register, police, stingray, warrant

FBI Says It Has A Warrant Requirement For Stingray Use; Has Exception Broad Enough To Ensure It Never Needs A Warrant

from the the-warrant-that-wasn't-there dept

As Mike covered here earlier, Sens. Grassley and Leahy are asking the FBI for more answers on its Stingray usage. Not that anyone should be holding their breath in anticipation of a response. The government's use of Stingray devices has been actively hidden from the public (and criminal defendants) for years. Local law enforcement's use has also been hidden, thanks to a bizarre set of non-disclosure agreements, both with the manufacturer (Harris) and the FBI itself.

So, while we wait for the heavily-redacted responses to the senators' queries to eventually arrive at an undetermined point in the far future, let's take a closer look at what the FBI has actually gone on record with about its Stingray use.

The good news (that actually isn't) is this: the FBI now has a warrant requirement for Stingray deployment. But there are (of course) exceptions.

[W]e understand that the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.

A Stingray device is rarely deployed from the comfort of the suspect's living room. In fact, it's safe to say this never happens. What does happen is that Stingrays are deployed from vehicles on public streets or flown overhead in aircraft. It would probably be safe to say that there has not been a Stingray deployment that didn't occur in a public place.

So, there's really no need to ever seek a warrant. The FBI can point proudly to its new warrant requirement as evidence of its respect for privacy, just as long as no one asks if there are any exceptions. Grassley and Leahy, however, have asked. And they have mastered the art of the understatement. They continue:

We have concerns about the scope of the exceptions.

The rule is demolished by the exception. There is no rule. There is no need for the FBI to ever seek a warrant for Stingray usage. If some weird situation does manage to crop up, it will probably involve some other exception (including ones that aren't listed here), and we're back to square one.

If and when the answers arrive, the numbers following these questions will be highly illuminating.

2.   From January 1, 2010, to the effective date of the FBI’s new policy:
a.   How many times did the FBI use a cell-site simulator?
b.   In how many of these instances was the use of a cell-site simulator authorized by a search warrant?
c.   In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d.   In how many of these instances was the cell-site simulator used without any legal process?
e.   In how many of the instances referenced in Question 2(d) did the FBI use a cell-site simulator in a public place or other location in which the FBI deemed there is no reasonable expectation of privacy?

Given the scope of the "public place" exception, the answers to (d) and (e) should be nearly identical. All that remains to be seen is how close those numbers are to 2(a).

Filed Under: 4th amendment, doj, fbi, privacy, stingray, warrant