Canadian Court Says Law Enforcement Doesn't Have To Hand Over Info On Stingray Devices

from the go-ahead-and-stack-the-deck dept

A Canadian court has ruled information about law enforcement's not-all-that-secret cell tower spoofers can stay secret. An ongoing attempted murder trial has implicated the use of Stingray devices. Prosecutors have refused to turn over information about the devices to the defendants -- something that at first provoked some consternation from the presiding judge. (via Slashdot)

Court of Queen's Bench Justice Glen Poelman initially agreed with defence lawyers Kelsey Sitar and Clayton Rice and granted them the right to question the CPS officer involved in using the MDI regarding its make, model, features and the circumstances that may or may not affect its use.

Unfortunately, prosecutors were able to sway the judge's opinion during an in camera briefing. The government invoked part of the Canada Evidence Act, granting it an apparent disclosure exemption on the theory handing over make and model information would be "contrary to the public interest."

Poelman has ruled the police investigative techniques are privileged, and he prohibited the release of the make, model and software of the MDI as well as "any further information which would have the effect of disclosing the technique by which MDI obtains cellphone identifier information."

This may end the line of discovery as it relates to law enforcement's IMSI catchers, but it doesn't necessarily mean the prosecution will be able to move forward. The defense plans to challenge the lawfulness of the prosecution itself. Withholding evidence possibly crucial to the defense doesn't make for a fair trial and it appears the defense will argue charges should be dropped if information isn't going to be produced. It's not like there isn't any precedent to work with. Earlier this year, the government chose to let 35 accused Mafia members go free rather than discuss Stingray use in court.

Clayton Rice, who is representing one of the accused in this case, has graciously sent over a copy of the court's ruling [PDF] on the issue. (This ruling was under a publication ban until mid-morning Tuesday.) Rice points out this is only an interim ruling and doesn't necessarily represent the final word on the subject. The court has granted the government the (possibly temporary) right to withhold certain information about its cell tower spoofers, which includes its make and model. The order is heavily redacted, which is one of the reasons it's only now being released despite having been decided back in August.

What can be sussed out from the redacted discussion is that the Calgary Police do not possess an actual Stingray -- the sort made by Harris Corp. That much is made clear in the ruling. The method used for tracking phones is also withheld, even though the technique used by the CPS has apparently been discussed publicly before. But you won't be able to find that information in the court's decision.

[I]t could be argued that all elements of CPS's MDI investigative techinique are publicly known. However, the Crown argues that it is not known that the CPS's MDI uses the [redacted] method, and the fact that information about the [redacted] procedure may be publicly accessilbe is not the same (especially in the internet age) as a police service verifying is accuracy or confirming publicly that this is the procedure they use. It is not necessarily well-known. The only public information about which Sgt. Campbell is aware that discussed the [redacted] technique is the [very lengthy redaction to end of paragraph.]

For the time being, however, the Calgary Police's cellphone interception hardware will remain a mystery. The question now is whether that desire for secrecy will cost the Crown its prosecution.

Filed Under: canada, cell towers, evidence, imsi catcher, stingray, transparency

First Circuit Appeals Court Latest To Overturn Playpen Suppression Order

from the Rule-41-changes-create-another-foregone-conclusion dept

A third Appeals Court has ruled on the tactics the FBI used to track down users of a dark web child porn site. And the third one to rule -- the First Circuit Appeals Court -- continues the government's shut out of suppression orders at the appellate level.

In the two previous cases to reach this level (Tenth and Eighth), the judges found the FBI's Network Investigative Technique to be a search under the Fourth Amendment. This wasn't much of an issue because the FBI had a warrant. The real issue was the warrant's reach: it was issued in Virginia but the NIT found a home in computers all over the US, not to mention the rest of the world.

The lower courts' decisions ordering suppression of evidence for the use of an invalid warrant have all been rejected by US appeals courts. Good faith has been granted to the agent securing the warrant, thus preventing suppression of evidence. In one case, the court even conjectured the deterrent effect of evidence suppression made little sense now that the FBI has statutory permission to ignore jurisdictional limitations when seeking warrants.

The First Circuit Appeals Court's decision [PDF] is no different than those preceding it. The previously-granted suppression is reversed and the FBI awarded good faith for its warrant application, which clearly told the Virginia magistrate judge the agency intended to violate the warrant's jurisdictional limits. This decision, however, limits its discussion to the good faith exception and the judges refuse to draw possibly precedential conclusions about the magistrate judge's legal authority to grant a "search anywhere" warrant.

The "search anywhere" part of the warrant the lower court found invalid is all academic at this point. Rule 41 jurisdictional limits have been lifted. But that did not happen until after this warrant was procured and deployed. Like the Eighth Circuit before it, the First Circuit decides this after-the-fact rule change somewhat negates the deterrent effect of suppression.

The First Circuit says good faith prevails, as the warrant was more or less explicit in its intentions and still managed to be signed by a judge. In fact, the court praises the FBI for applying for a warrant it likely knew violated pre-rule change jurisdiction limitations.

We are unpersuaded by Levin's argument that because, at least according to him, the government was not sure whether the NIT warrant could validly issue under Rule 41, there is government conduct here to deter. Faced with the novel question of whether an NIT warrant can issue -- for which there was no precedent on point -- the government turned to the courts for guidance. The government presented the magistrate judge with a request for a warrant, containing a detailed affidavit from an experienced officer, describing in detail its investigation, including how the NIT works, which places were to be searched, and which information was to be seized. We see no benefit in deterring such conduct -- if anything, such conduct should be encouraged, because it leaves it to the courts to resolve novel legal issues.

I guess the court would prefer to tangle with legal issues it hasn't seen before. This would be one of them -- at least in terms of thousands of searches performed with a single warrant from a seized child porn server located in Virginia. The legal issues may be novel but the end result is more of the same: good faith exception granted and the admission of evidence questionably obtained.

Filed Under: doj, evidence, fbi, first circuit, gag order, nit, playpen, suppression order

Georgia Election Server Mysteriously Wiped Clean After Lawsuit Highlights Major Vulnerabilities

from the yeah-whoops-a-daisy dept

For as long as Techdirt has existed, we've highlighted how most implementations of electronic voting simply aren't safe or secure. The Diebold disaster in 2006, Sequoia's security scandal in 2008, and a rotating flood of similar stories since, have driven this point home time, and time, and time again. And despite these warnings neither the companies that make these machines, nor the election commissions or local governments tasked with overseeing them, have done enough (or, in many cases, much of anything) to ensure that our Democratic process is secure.

The latest example of just how not under control this problem is comes out of Georgia, where reports indicate that somebody managed to completely wipe a server integral to a lawsuit against Georgia election officials. The lawsuit, filed by a coalition of election reform advocates, is attempting to force Georgia to retire antiquated and heavily-criticized election technology that has been under fire in the media since June, after security researchers indicated that the touch-screen machines could be easily tampered with without leaving much of a trace:

A misconfigured server, Logan Lamb discovered last August, had left Georgia’s 6.7 million voter records and other sensitive files exposed to hackers. And it may have been left unfixed for seven months. The vulnerability might have allowed attackers to plant malware and possibly rig votes or wreak chaos with voter rolls by deleting or altering records — a major concern amid heightened sensitivity to state-sponsored Russian election hacking.

Shortly after the lawsuit was filed, the servers of interest in the case were mysteriously wiped by technicians at the Center for Elections Systems at Kennesaw State University, which oversees the state’s election system. The Associated Press only discovered the wipe after obtaining an email from an assistant state attorney general to plaintiffs in the case. Efforts to determine who requested that the server be wiped clean have so far gone nowhere:

The Kennesaw election center answers to Georgia’s secretary of state, Brian Kemp, a Republican who is running for governor in 2018 and is the main defendant in the suit. A spokeswoman for the secretary of state’s office said Wednesday that “we did not have anything to do with this decision,” adding that the office also had no advance warning of the move. The center’s director, Michael Barnes, referred questions to the university’s press office, which declined comment.

Plaintiffs in the case have argued that data from last November’s election and a special June 20th congressional runoff cannot be trusted due to the unresolved flaws in the machines. And while the election server would have gone a long way toward answering that concern, it was wiped clean on July 7 -- just four days after the lawsuit was filed. Two backup servers were subsequently wiped clean on August 9, just as the case was moving to federal court.

Filed Under: e-voting, elections, evidence, georgia, servers, spoliation, voting integrity, wiped

Court Says 'Possible' Just As Good As 'Probable;' Lets DEA Keep Evidence From Warrantless Search

from the good-luck-limboing-under-that-low-bar,-defendants dept

The Ninth Circuit Appeals Court has handed down a decision which appears to lower the bar for probable cause. The government's evidence -- obtained via a warrantless search -- will remain unsuppressed. Here's the summary of the decision [PDF]:

The panel affirmed the district court’s order denying the defendant’s motion to suppress contraband seized during a warrantless search of the defendant’s truck.

The panel held that under the totality of the circumstances, there was probable cause to believe that contraband would be found in the truck, and that the search was therefore permissible under the automobile exception to the warrant requirement.

It's the "totality of the circumstances" that's the problem. The court did a lot of scribbling in the margins to help the government's probable cause math add up. The DEA had lots of stuff that was almost proof of something, but lots of key elements were missing. The opinion is riddled with details of agents verbally filling in gaps in their surveillance with assumptions.

[A]gents intercepted another call between Penitani and Faagai, in which Faagai was attempting to locate Penitani at the Pearlridge Shopping Center for what appeared to be a pre-planned meeting. Drug Enforcement Administration Special Agent Clement Sze (“Special Agent Sze”) testified that he believed that although agents were not able to conduct surveillance of that meeting, they believed, based on the entirety of their investigation, that Penitani and Mitchell were meeting Faagai to supply him with methamphetamine.

The beginning of the DEA's bad math: a meeting agents did not actually hear or see. More fuzzy math follows.

On November 5, 2012, agents intercepted a text message from Faagai to Penitani in which Faagai said that he was going to Costco in Kapolei “to buy food for [his] house” and that if Penitani “gotta buy food for [Penitani’s] house,” they should meet at Costco. Special Agent Sze testified that he believed that Faagai was using “food” as a code word for “money.”

Or it could just be food. Since the defense didn't challenge these assertions, the Appeals Court decides to take the agent at his word. Agents attempted to catch the dealers in the act, but missed an opportunity.

Agents traveled to the Costco in Kapolei and observed Penitani and his then girlfriend, Keschan Taylor, exit Costco and drive away. Agents did not see Faagai in the area, but Special Agent Sze testified that the agents believed that the meeting between Faagai and Penitani had already taken place.

Another unobserved meeting, presumed by the government to have taken place and, presumably, been of an illicit nature.

Having intercepted another conversation about "food" and "tools" to take place at a local restaurant, agents headed out to observe the hand-off. Again, they missed their marks.

Law enforcement agents conducted surveillance at the Jack In The Box and did not see Faagai or Penitani. At 8:14 p.m., agents intercepted a text message from Penitani to Faagai changing the location of the meeting to a 7-Eleven. The agents drove to the 7-Eleven at 8:30 p.m., where they saw Faagai in the parking lot, leaning into the passenger side window of Penitani’s car. Penitani and Faagai had already been there for approximately 15 minutes.

Once again, Special Agent Sze makes an assumption and, once again, the court finds it credible.

Special Agent Sze testified that he believed that the drug transaction had already occurred by the time agents arrived on scene.

Based on this wealth of horseshoe/hand grenade information, agents performed a pretextual stop and proceeded to search Faagai's vehicle without a warrant. A half-pound of methamphetamine was discovered along with the usual paraphernalia. The Appeals Court says all the gaps in info and all the assumptions made about unobserved meetings and unheard conversations is fine. It all adds up to Faagai's vehicle being the "more than likely" final resting spot of drugs no DEA agent actually saw change hands.

At the 7-Eleven, agents observed Faagai walk away from Penitani’s car and toward his own truck without anything in his hands. Agents did not observe the entirety of the meeting, which lasted roughly 15 minutes. Because the circumstances indicate the purpose of the meeting was to engage in a drug transaction, there is probable cause to believe that Penitani had delivered drugs (the promised “tools”) to Faagai, and that these drugs could be found in Faagai’s truck.

Why in Faagai’s truck? We know that there was probable cause to believe Penitani brought the “tools” (the drugs) so that Faagai could “get back to work” and not “lose [his] job” (deal the drugs). We know that Faagai arrived at the 7- Eleven in a vehicle, because he drove away in his truck. When the police saw Faagai leaning into the window of Penitani’s car, he had nothing in his hands.

Where could the “tools” (drugs) be located? In Penitani’s car? Unlikely, because the purpose of the meeting was for Penitani to deliver drugs to Faagai and Faagai left the scene in his truck. On Faagai’s person? Perhaps, but unlikely given that in prior transactions, Penitani had dealt in pounds of methamphetamine. Hidden in the environs of the 7- Eleven? Unlikely, given the high value of the drugs. In Faagai’s truck? More likely than not.

Judge Kozinski's dissent illustrates the dangers of allowing the government to substitute expertise for observation when it comes to commonly-used terms and meetings no one saw take place.

The government’s entire case rests on four meetings between Faagai and John Penitani, a suspected meth dealer. Despite observing most of these meetings and assiduously wiretapping Penitani’s phone, officers never saw a handoff of money or contraband, nor heard an explicit mention of drugs. In fact, they saw and heard nothing objectively suspicious.

The most probative evidence supporting the search was a conversation between Penitani and Faagai where they discussed meeting at Costco to buy food. Agents testified that they “believed [food] to be a code” for drugs. But there was no expert testimony or any other evidence supporting the speculation that food stood for drugs. See United States v. Bailey, 607 F.2d 237, 240 & n.6 (9th Cir. 1979) (discussing expert’s testimony on the meaning of alleged code words). Many people go to Costco to buy food. If talking about shopping for food at Costco were sufficient to justify a search, many of us would be searched by the police twice a week—thrice right before Thanksgiving. Nor does it make any sense to substitute food for drugs when talking about where to meet. If Penitani and Faagai were meeting up to conduct a drug deal, why specify the purpose of the meeting? Why say “Let’s meet at Costco for a drug transfer” rather than just “Let’s meet at Costco,” with the purpose of the meeting understood?

A few judges have called out the government for this behavior, making claims that would turn a large number of non-criminals into potential suspects. Drug dealers are humans and do human things just like millions of non-drug dealers. They shop at Costco just like innocent people do. But the government would have us believe -- "based on training and expertise" -- that common activities are suspicious, especially when the government is already engaged in an investigation. Even the most innocuous actions become sinister when the government is seeking to reach a foregone conclusion.

But there's more to it than that. Kozinski also points out the DEA's "training and expertise" statements often paint contradictory situations as equally suspicious. If the government wants to keep making arguments about common activities being the height of criminal suspicion, the least it could do is be consistent.

The fact that the two men decided to meet in a place with “hardly any people” cuts the wrong way. The government commonly argues that drug dealers intentionally seek out busy locations because a “high volume of pedestrian and vehicle traffic can mask drug-dealing activity.” United States v. Ruiz, 785 F.3d 1134, 1138 (7th Cir. 2015). Here, the government claims the opposite, evidently trying to have it both ways. At best, this fact is irrelevant: There was nothing incriminating about the two men’s preference for a quieter location.

Kozinski sums up his dissent this way:

The majority strings together a sequence of events like beads on a strand, but doesn’t explain how any of them provide probable cause that Faagai was carrying drugs in his car when he was stopped.

And here's the inevitable outcome of this decision, which is published and precedential:

Here’s what this case boils down to: Officers had a hunch that a drug transaction was going down. They saw nothing obviously suspicious, but got tired of waiting, watching and wiretapping. They then jumped the gun by executing a warrantless search. Until today, this was not enough to support probable cause, but going forward it will be. This is a green light for the police to search anyone’s property based on what officers subjectively believe—or claim to believe—about someone’s everyday conduct. That puts all of us at risk. Accordingly, I dissent, and I’m off to Costco to buy some food.

Edge cases like these need to be watched closely by judges. The courts have greatly expanded law enforcement power over the years at the expense of the Bill of Rights. Lowering probable cause to possible cause just makes it easier for officers to have their illegal search and their evidence too.

Filed Under: 4th amendment, 9th circuit, evidence, fruit of a poison tree, probable cause, warrant

Another Appeals Court Denies Suppression Of Evidence Obtained With An Invalid FBI Warrant

from the so-much-for-valid-warrants-being-better-than-invalid-ones dept

A second appeals court has handed down a ruling on the constitutionality of the Network Investigative Technique (NIT) deployed by the FBI during its Playpen child porn investigation. The Tenth Circuit Appeals Court overturned the suppression of evidence granted by the lower court, ruling that the FBI's NIT warrant was invalid but that the agent's "good faith" reliance on the warrant prevented exclusion of the evidence.

Multiple courts have found the NIT warrant invalid. The warrant was obtained in Virginia but the search the FBI's malware performed accessed computers all over the world. Prior to the recent Rule 41 changes, warrant execution was limited to the jurisdiction it was obtained in. The Appeals Court worked around the jurisdictional limit by reasoning the NIT was sent from Virginia and returned info gathered in the same jurisdiction. It just kind of glossed over the part where computers located all over the nation were briefly infected by the NIT to obtain the information needed to pursue suspects.

The Eighth Circuit Appeals Court decision [PDF] finds more problems with the NIT warrant and execution than the Tenth Circuit did. The consolidated appeal, however, ultimately finds in favor of the government, overturning two lower court suppression orders.

First, the good news. The appeals court finds the FBI does indeed need warrants to perform these searches, even if IP addresses aren't necessarily protected by the Fourth Amendment.

In this case, the FBI sent computer code to the defendants’ respective computers that searched those computers for specific information and sent that information back to law enforcement. Even if a defendant has no reasonable expectation of privacy in his IP address, he has a reasonable expectation of privacy in the contents of his personal computer. [...] Moreover, the NIT retrieved content from the defendants’ computers beyond their IP addresses. We conclude the execution of the NIT in this case required a warrant.

The court also disposes of the government's "but it's kind of just a tracking device" argument:

Although plausible, this argument is belied by how the NIT actually worked: it was installed on the defendants’ computers in their homes in Iowa. The government rightly points out that our court interprets Rule 41 flexibly in light of advances in technology... but we agree with the district court that the “virtual trip” fiction “stretches the rule too far,” We agree with the majority of courts that have reviewed the NIT warrant. These courts have concluded that “the plain language of Rule 41 and the statutory definition of ‘tracking device’ do not . . . support so broad a reading as to encompass the mechanism of the NIT used in this case.” Id. Thus, we hold that the NIT warrant exceeded the magistrate judge’s jurisdiction.

It also agrees with the lower courts' findings the warrant was invalid from the moment it was obtained, since the NIT was clearly going to be traveling outside of the issuing judge's jurisdiction. But that's where the good news ends. The appeals court applies the "good faith" exception and declares the requesting agent -- who knew the NIT would travel outside the jurisdiction and suggested as much in the warrant request -- could rely on a warrant signed by a judge to execute these extrajurisdictional searches.

The defendants also argue that the NIT warrant was facially deficient because FBI agents should have known that a warrant purporting to authorize thousands of searches throughout the country could not be valid. Specifically, Horton argues that “there can be no credible argument that officers reasonably believed that none of the 214,898 members of [Playpen] were located outside of Virginia.” We, however, will not find an obvious deficiency in a warrant that a number of district courts have ruled to be facially valid. Further, we have declined to impose an obligation on law enforcement to “know the legal and jurisdictional limits of a judge’s power to issue interstate search warrants.” Law enforcement did not demonstrate bad faith, and we will apply the Leon balancing test as instructed by the Supreme Court.

So, law enforcement officers are not required to know the legal limits of the warrants they seek. Apparently, neither are judges, as the judge signed off on this warrant despite being told it would be executed outside of his jurisdiction.

But that's not the worst part of the opinion. The worst part is this: the court says there's no deterrent value in suppressing evidence obtained with a facially-invalid warrant because the law changed after the fact.

Because Rule 41 has been updated to authorize warrants exactly like this one, there is no need to deter law enforcement from seeking similar warrants.

Under this rationale, anyone currently incarcerated for marijuana possession or distribution in states where weed is now legal should have their sentences immediately vacated. After all, there's no deterrent effect in keeping them locked up, now that both actions have become legal.

So, it's now 2-0 in favor of the FBI in federal appeals courts. In the future, its NIT activities won't receive much scrutiny. But it appears everything it did in violation of Rule 41 prior to the rule changes is being forgiven by higher courts -- whether with generous applications of the "good faith" doctrine or by making the Rule 41 changes effectively retroactive.

Filed Under: 10th circuit, 4th amendment, 8th circuit, appeals court, evidence, fbi, malware, nit, playpen

Court Rejects Cell Site RF Signal Map In Murder Trial Because It's Evidence Of Nothing

from the anything-to-avoid-asking-for-a-warrant dept

The Maryland Court of Special Appeals has handed down a ruling [PDF] on quasi-cell site location info. The evidence offered by the state isn't being so much suppressed as it is being rejected. The information wasn't obtained illegally and no rights were violated. Rather, the court finds the evidence to be questionable, as in "evidence of what, exactly?" [via EvidenceProf Blog]

The defendant in the case is charged with murder. Bashunn Phillips filed a motion to exclude the evidence, which was granted by the lower court. The state appealed. But there's nothing in it for the state.

The "evidence" -- which is going to carry around scare quotes for the remainder of this post -- doesn't tie Phillips to anything. What was submitted isn't even the equivalent of coarse cell site location info. What the state submitted is something that can easily be obtained without a warrant… because it doesn't actually target any person at all.

Phillips filed a motion in limine on August 7, 2015, seeking to exclude the RF signal propagation map and related testimony. Phillips argued that the method used to create the map was not generally accepted as reliable within the relevant scientific community under Maryland’s Frye-Reed test for admissibility of evidence based on novel scientific methodology. Phillips acknowledged that cell phone tower “ping” evidence is admissible, but drew a distinction between the method used to create the RF signal propagation map and the collection of historical cell phone “ping” evidence.

This is an interesting form of evidence -- something that amounts to cell tower hearsay. It's not like it's much trouble to obtain historical cell site data. This can be done without a warrant in Maryland, despite the recent ruling that requires warrants for Stingray deployment. Historical cell site location data is still a third-party record as far as the federal courts are concerned, so good faith, if nothing else, would have salvaged the warrantless harvesting of this data.

For whatever reason, local law enforcement chose to have the FBI perform a "drive test" of cell towers in the area of the criminal activity, ten months after it happened. Perhaps law enforcement wanted to believe this data would indicate something and allowed itself to be persuaded by pitches like this one, from a company that offers "cell site forensics" to law enforcement agencies.

Cell Site Analysis (CSA) the science of reconstructing the physical movements of a mobile telephone or telecommunication device. The evidence produced from such advanced investigations can be especially powerful in attributing contact between individuals, proximity to a scene of crime, patterns of movement of suspects, and testing the strength of alibi evidence.

These assertions are undermined further down the page when the company explains the limits of drive tests:

How accurate is Cell Site Analysis? This is a common question and there is no short answer. A number of factors come into play, including the type of signalling technology used (GSM/UMTS/CDMA), the local topology (man made or natural obstructions), the height of the antennae, type of CDRs available, physical location of other masts, angling of the transceivers, and degree of network activity (other subscribers). In some instances Cell Site Analysis can be accurate to a few metres, or sometimes a few streets (approximately a postcode).

In other words, most likely not all that accurate. Pinning down a historical cell signal based on a 10-month post facto RF analysis is extremely iffy. Being within a few streets of a committed crime proves nothing. Given the number of variables, these tests are perhaps best left to their original purpose: providing cell service providers info on possible dead zones. That doesn't stop Afentis Forensics from wrapping up this paragraph in an overconfident manner.

However, the technique remains an extremely powerful tool to test an alibi, to show that a number of people were together at a certain time, or to highlight the fact that a suspect was at a crime scene.

The defense in this case pointed out drive tests are indicative of nothing:

Phillips maintained that drive tests are routinely performed by cell phone companies to improve coverage and minimize “dropped calls,” but that they are not generally accepted in criminal investigations. Testifying for the defense, William Folson, accepted as an expert witness “in the field of cellular technology and historical cell site analysis” explained that he “consider[s] [drive tests] a waste of time” because “[t]hey add no value to the historical analysis of a cell phone.” He further testified that the manner in which Special Agent Fennern had performed the drive test was not accepted as reliable in the relevant scientific community. Mr. Folson explained that the RF signal range in December 2013 when the murder occurred would be different than the range in October 2014 when the drive test was conducted because the strength of RF signals fluctuate. Because of this, according to Mr. Folson, a drive test is not representative of the strength of the RF signals on any other date. He also pointed out that drive tests were not peer reviewed, accepted by the scientific community, or used in criminal investigations.

It's almost impossible to find a drive test submitted as evidence in a criminal investigation. Granted, a search for this terminology is bound to miss a few cases, especially those behind the US government's PACER paywall, but the lack of hits suggests this "evidence" is very rarely submitted in criminal trials. What can be found suggests the method used by the FBI agent in this case is completely wrong. Ten months after the fact gives you nothing but garbage.

[T]he coverage area of a cell tower should never be part of an analyst's mapping or court presentations unless that information comes directly from the wireless telephone company in the form of a radio propagation map or in some rare cases, in the form of drive testing that occurred contemporaneous to the date and time of the incident.

Apparently, this "evidence" is a bit more popular in Australia. A paper by a legal aid group discusses several problems with using drive tests/RF signal propagation maps as evidence.

Topography, weather, usage load, broadcast wattage, and overlap of cell coverage entail that to go to point A and make test calls now with the result that some or all of those test calls go through a specified sector of a particular base station does not ‘prove’ that at some other earlier time calls from point A went through that same specified sector. At that other time they may have gone through another sector. When a user places a call, the cell phone connects to the cell site with the strongest signal. Indoor or outdoor use of the phone and cell phone orientation to the user’s head can alter the strength of the signal. These are important considerations when attempting to recreate an alleged past event.

In general it is often easier to be more definitive about the converse proposition, namely that from the Cell ID information it is unlikely that the call was made (or received) outside a specified area. Access from the Telcos to propagation prediction modelling (ie for both ‘dominant’ and ‘possible’ coverage of relevant sectors) is helpful but insufficient to be certain about phone location.

In this context of qualified uncertainty, it is highly misleading to infer positive location with the phrase ‘the Cell ID identified with a call is consistent with the call being made in that location.’

In the Maryland case, the state offered up two witnesses to rebut the "this data doesn't prove anything" defense argument.

Providing a different opinion and testifying for the State, Special Agent Fennern was accepted as an “expert in the field of historical cell site analysis, cellular technology, and [] radio frequency drive testing for cell phone mapping.” Agent Fennern opined that factors such as weather only have a “minimal” impact on radio frequency strength. He also testified that, relying on information provided by cell phone companies, the RF signal strength only varied by five or ten percent.

The State also offered the testimony of T-Mobile employee Stephen Willingham, accepted as an expert in radio frequency engineering. He testified that cell phone companies use drive tests for “competitive analysis reasons.” He explained that when a customer complains about a missed call, a cell phone company will use a drive test to attempt to recreate that dropped call to identify a gap in service. Mr. Willingham testified that, over time, radio frequency “[f]ootprints remain consistent as long as nothing major has changed[,]” referring to the physical layout of the cell site, such as antennas and equipment. He stated that the maximum variation he had seen for a footprint was a quarter mile.

Even if all the variables stay the same, the only thing that can truthfully be said is they're possibly accurate within a quarter mile. If that's the case, it's impossible to claim someone was at the scene of a crime using nothing more than an RF propagation map. And, if the arguments made by the defendant are any indication, the state never bothered obtaining or submitting historical cell site location info (the "ping" evidence).

The appeals court agrees with the lower court's opinion: the state can't show anyone has accepted drive tests as a reliable source of evidence in criminal cases.

After determining that the digital forensic science field is the relevant scientific community, the court found that the State’s experts lacked familiarity with that field and were unable to produce studies or peer-reviewed articles in that field supporting the reliability or general acceptance of drive tests for forensic purposes. The court ultimately concluded that the State did not establish that drive tests as used by the FBI are generally accepted in the digital forensic science community. The court then mused that, even if the drive test were considered generally accepted and reliable, the State’s experts were not qualified to testify because they were not members of the digital forensic science community and failed to satisfy the requirement of Maryland Rule 5-702.

This case is exceptionally weird, considering local law enforcement had help from the FBI. Unless the defendant's provider was extremely proactive in scrapping old location data and/or was unresponsive to subpoenas for call records, the state should have had something better than a drive test to place the defendant at the scene. But this is the only evidence the defendant sought to exclude, which suggests other cell records were never introduced. If so, this is a case where law enforcement had several options, but for some reason chose to use the worst one.

Filed Under: cell site, evidence, location, maryland, rf

Prosecutors Overturn More Than 21,000 Drug Convictions In Wake Of Massive Drug Lab Misconduct

from the you're-free-to-go-x-21k dept

Back in 2012, it was discovered that a Massachusetts state drug lab technician had falsified thousands of tests submitted as evidence in criminal cases. Technician Annie Dookhan was able to "produce" three times as many test results as her coworkers, mostly by never actually testing the submitted substance -- something that went unquestioned for far too long. Dookhan went to jail for three years, but many of those convicted on faulty evidence spent far more time locked up.

Dookhan's prolific fakery resulted in a list of 40,000 cases possibly tainted by her work. This list was turned over to prosecutors, who managed over the next few years to trim it down to 23,000 possibly-tainted convictions. Faced with the daunting task of sorting this all out and notifying former defendants, the district attorney's office decided the best approach was to do as little as possible.

First, with an unbelievable amount of hubris, it argued that those who had already served time for bogus convictions likely didn't care whether or not they'd been exonerated post facto. It can't be that the prosecutor's office doesn't know drug convictions keep people unemployed/underemployed and/or car-less/homeless. It appears the office simply has no empathy for those it's helped convict.

Then it did as little as it could to inform those who had been possibly wrongfully convicted. It sent out poorly-targeted mass mailings that looked like government junk mail, rather than the life-changing exonerations they possibly were. No research was performed to ensure current addresses were used and the letter itself didn't inform recipients of their legal rights and remedies.

A court finally stepped in and ordered the DA's office to come up with a plan of adequately addressing this backlog of 21,000 possibly-wrongful convictions. These plans would have to be approved by the court, which obviously felt the DA's office would mount another half-hearted effort without direct supervision.

Faced with having to lift a few fingers to locate and inform citizens of their rights, remedies, and their chance to un-fuck their lives, the DA's office has opted again to do as little as possible. However, in this case, the minimum of effort is probably the course of action it should have taken in the first place.

On April 18, nearly five years after Dookhan’s confession, prosecutors submitted lists of about 21,587 tainted cases with flawed convictions that they have agreed to overturn. The state’s highest court must still formally dismiss the convictions.

Once that happens, many of the cleared defendants will be freed from the collateral consequences that can result from drug convictions, including loss of access to government benefits, public housing, driver’s licenses and federal financial aid for college. Convicted green card holders can also become eligible for deportation, and employers might deny someone a job due to a drug conviction on their record.

The very small number of cases the state isn't dismissing -- 320 of them, according to prosecutors -- shows how heavily the state relies on drug lab evidence to secure convictions. These cases are ones prosecutors feel would still hold up in court even without drug lab evidence. Possibly there are other cases with similarly strong evidence once Dookhan's fakery has been excised, but the DA's office has had zero desire to reexamine most of the 23,000 cases Dookhan's work affected.

Odds are, there are a great many people who wrongfully served more jail time than Dookhan rightfully did. The fallout from this is going to cost Massachusetts taxpayers a whole lot of money. Not only did they pay Dookhan to not perform her duties for several years, but they'll be on the hook for the inevitable lawsuits this mass exoneration will produce.

Filed Under: annie dookhan, drug convictions, drug lab, evidence, massachusetts

Cop Arrested, Fired After Wife Captures His Abusive Actions On His Own Body Camera

from the accidental-sting-operation dept

This is one of the strangest "but for video" cases ever. We know many cops are hesitant to clip body-worn cameras on themselves for a variety of reasons. The official statements always express concern about privacy, as though people interacting with public servants somehow believe these interactions are private. Others show concern for police officers' privacy, as though the public is really hoping to FOIA footage of officers sitting in the break room or using the restroom.

Deep down, everyone knows the cameras are a tool of accountability, albeit one that's far from perfect. Body camera footage frequently goes "missing" when force is deployed questionably. And it's completely possible to make the footage subjective with strategic body positioning and constant yelling of exonerative phrases like "Stop resisting!"

So, it's accountability in its infancy, run through a layer of law enforcement-friendly filters (footage is controlled by police officers and often sheltered from FOIA requests). But it's much better than what we had before, where all action had to take place in front of stationary dashboard cameras.

Still, there are plenty of bugs -- both those inherent to the system and those created by law enforcement resistance -- to be worked out. We've seen cops damned by their captured footage and we've seen officers exonerated by footage that contradicts arrestees' complaints.

What we haven't seen before is a camera being activated by someone other than the cop in possession of it. And we definitely haven't seen any situations where the footage captures off-duty violence. This is a new one, and it's likely to lead to another "privacy" discussion by the time it's all sorted out. (via PoliceMisconduct.net)

A North Charleston Police officer was arrested for assaulting his wife Sunday after police say the incident was captured on his body camera. Hanahan Police say the officer, Nicholas Palumbo was arrested early Sunday morning.

According to an incident report, Palumbo's wife told him she wanted a divorce. The report states Palumbo became very irate and pushed his wife to the ground in their kitchen. Police say after the altercation started Palumbo's wife went into the bedroom and turned on his body camera.

According to the report, Palumbo came into the room, pinned his wife to the bed and threatened to strike her in the head with his fist while shaking her. His wife told investigators she was in great fear for her safety and the safety of her children. The report states she did not know where her husband had gone and was afraid he would return home and cause physical harm to her.

I'm not sure which part is more amazing: the forethought of the abused spouse to activate the camera or the fact that the footage was actually viewed by someone at the police department.

We know officers protect officers first. Perhaps being the wife of an officer grants you more attention and respect than a random civilian with a list of allegations. Whatever the case is, the department viewed the footage and arrested the officer. Even more surprising, the officer was immediately fired. I guess this decision was made easier by his bail requirements, which forbade him from possessing guns or ammo -- something every on-duty cop generally has on them or easy access to.

It's a petard-hoisting of sorts and definitely an anomaly in the pantheon of body-worn cameras. No doubt other cops with the same domestic issues will be keeping a closer eye on their issued gear during their off-duty hours. And there will definitely be challenges to the evidence, should this go to trial.

Arguments will be made about surreptitious recordings being used to fire a police officer, but those shouldn't get too far. South Carolina is a one party consent state when it comes to recordings. The fact that it was recorded in a private home (rather than in a public area) makes it a bit more complicated, but the recording should be treated no differently than the spouse's oral testimony. The recording just makes it a lot tougher to challenge the spouse's domestic abuse allegations.

Whatever happens, it's one for the "but for video" record books: body worn camera as the prosecution's star witness in a domestic assault case.

Filed Under: body cameras, evidence, police

DOJ Memo Shows NSA And White House Lawyers Mainly Unconcerned About Evidence Obligations In Criminal Trials

from the let's-temporarily-sort-of-care-about-something dept

Charlie Savage of the New York Times has obtained another document detailing the internal guidelines of the NSA's STELLAR WIND program as a result of the NYT's long-running FOIA lawsuit against the government. The new document is a memo from the Department of Justice, which details its lawyers' attempts to suss out the government's obligation to defendants when it comes to evidence derived from classified surveillance programs.

As Savage points out in his post, much of the NSA program's inner workings (and abuses) have been detailed in previously-released documents, including an Inspector General's report obtained by the Times in 2015. That doesn't make this document [PDF] unworthy of a read, however. It doesn't provide more detail on the program or its apparent abuse, but it does make it clear the government didn't seem too concerned about potential due process violations arising from the obscuring of surveillance-derived evidence.

First, the memo points out very few DOJ lawyers and prosecutors have been "read in" to the program, which immediately makes it more difficult to balance adversarial issues in criminal prosecutions where the paper trail leads back to the NSA's warrantless surveillance.

But the OLC (Office of Legal Counsel) doesn't have the right lawyers on staff to make this determination. Then-OLC head John Yoo himself admits (via a quotation in the memo) that "criminal law is not [his] area." To remedy this, the OLC brought in two lawyers from the DOJ's Criminal Division -- Patrick Rowan and Christopher Wray -- to analyze processes and check for adherence to Rule 16 (defendant' communications and statements in the government's possession) and Brady (exculpatory evidence) obligations. But it appears once the two DOJ lawyers were "read in," they were forgotten about.

Wray told the OIG that after his and Rowan's read-in, they "were kind of left on our own." He said that no one directed him or Rowan to continue studying the Rule 16 issues or the government's Brady obligations in connection with international terrorism prosecutions, nor did anyone tell them to develop any judgments or opinions on the subject.

What is clear is that whatever changes were made at the NSA and DOJ were the result of journalism. According to Rowan's statements to the NSA's Inspector General, the NSA was, at best, "generally aware" of its evidence disclosure obligations "prior to the December 2005 disclosure… of the Stellar Wind program in The New York Times."

But the process in place -- and likely the process that continues today with the OLC's blessing -- was to spot cases that might present discovery issues and take steps to hide the origin of that evidence.

Rowan stated that if the NSA located any responsive but classified information, it would be expected to notify senior Justice Department officials with the requisite clearances about the information. Rowan said he was confident that if Brady information were known to the NSA, it would be brought to the attention of the Department and steps would have been taken to dismiss the case or otherwise ensure the program was not disclosed.

If the government wanted both program secrecy and a successful prosecution, the FBI would engage in something that looks an awful lot like parallel construction.

[Rowan] stated that the FBI had "walled off" any evidence it collected from inclusion in criminal cases by tipping out Stellar Wind-derived information under [REDACTED] with a caveat that the information in the tipper was "for lead purposes only." Rowan noted that OIPR [the DOJ's Office of Intelligence Policy and Review] also had in place a scrubbing process to delete program-derived information from FISA applications. Rowan expressed confidence that these mechanisms ensured that no program information was used in international terrorism prosecutions. Finally, Rowan stated that the FBI is "very quick to get FISAs up," thereby minimizing the likelihood that the NSA's Stellar Wind database would be the sole repository of Brady material.

The DOJ lawyers felt evidence issues still remained mostly unaddressed, but the OLC apparently lost interest shortly thereafter. The new head of the OLC discussed some issues with Rowan but told the DOJ "he did not believe the OLC followed up on Rowan's request that it continue researching these issues." Another OLC official said he had seen Rowan's work, but the office apparently decided Yoo's memo (the same Yoo who stated criminal law "wasn't his area") was the final word on the subject. This same official also stated he wasn't aware of any "formal procedures" for handling surveillance-derived evidence arising from the DOJ's examination of the subject.

The other DOJ lawyer "read in" to the program confirmed the OLC official's statement.

Wray also told us there was no organized Departmental effort to establish formal procedures for reviewing international terrorism prosecutions to comply with Rule 16 disclosure requests and Brady obligations. He said "the thinking was" that the Rowan memorandum was the "first step" toward devising "some kind of systematized process" for such reviews. However, we found no indication that OLC followed up on Rowan's request to further study these discovery issues with any kind of written product.

So, the answer on prosecution evidence obligations comes from a guy who knows little about criminal law. On the plus side (haha), he's a strong proponent of making all rights and liberties subservient to national security concerns. The FBI does its part to protect NSA surveillance programs by erecting parallel evidence gathering, which means defendants might actually be able to see the evidence used against them, but be unable to challenge the constitutionality of the original collection. This all works out very well for the government, which somehow managed to slack its way into a playing field tilted towards the prosecution despite having one of its flagship surveillance programs splashed all over the pages of the New York Times. Remind me again how leaks damage the government's ability to pursue investigations and prosecutions?

Filed Under: christopher wray, discovery, doj, evidence, john yoo, nsa, olc, patrick rowan, stellar wind, surveillance

Canadian Prosecutors Cut Loose 35 Mafia Suspects Rather Than Turn Over Info On Stingray Devices

from the how-American-of-them dept

Canadian law enforcement brought down a massive criminal conspiracy. Now, thanks to information it doesn't want to release to the court, most of what was brought down will be re-erected by the suspects it's cutting loose. (h/t Techdirt reader Pickle Monger)

Thirty five people accused of serious crimes like kidnapping and drug trafficking saw the cases brought against them in a major RCMP investigation into the Montreal Mafia dropped on Tuesday because the Crown no longer wants to prosecute them.

The Crown’s sudden change of stance in an investigation dubbed Project Clemenza meant there are only 11 accused left with cases pending following three series of arrests made between 2014 and May last year. Federal prosecutor Sabrina Delli Fraine informed Quebec Court Judge Lori Renée Weitzman of the Crown’s position during a hearing at the Montreal courthouse.

One of the defendants released is believed to be one of the leaders of the Montreal Mafia (which sounds like a Chicago mob farm team). The suspects were snared through the interception of communications, many of which appeared to originate on BlackBerry phones. As was covered here a year ago, the RCMP used a built-in BlackBerry "feature" to intercept and decrypt over "one million messages" during its investigation of a Mafia killing.

Here's the key part of the interception effort:

The RCMP maintains a server in Ottawa that "simulates a mobile device that receives a message intended for [the rightful recipient]." In an affidavit, RCMP sergeant Patrick Boismenu states that the server "performs the decryption of the message using the appropriate decryption key." The RCMP calls this the "BlackBerry interception and processing system."

This is part of the reason these Mafia defendants are seeing their charges dropped. The RCMP does not want to publicly discuss its BlackBerry interception methods. The other reason has to do with how the RCMP tracked down the phone numbers it wanted to intercept.

The RCMP used a mobile device identifier and Stober ordered that the Crown disclose information like the device’s signal strength and its potential impact on a BlackBerrys ability to make or receive phone calls while text messages are being intercepted from it.

This would likely be RCMP Stingray devices. Just like here in the US, Canadian law enforcement would rather see perps walk out of courtrooms than turn over information on interception efforts to defendants.

This is the largest of the RCMP's catch-and-release efforts, but it isn't the first. The National Post points out a similar dumping of defendants occurred last year for the same reason.

The Crown apparently does not want to disclose the investigative techniques used with the device. Last year, it did an about face in a murder trial and six men who were about to go on trial for the first-degree murder of Mafioso Salvatore Montagna were able to plead guilty to the lesser charge of conspiracy to commit murder.

At least in that case, law enforcement still ended up with a few convictions -- albeit on charges lower than what it had hoped to obtain going in.

Cell tower spoofers are resulting in a lot of contradictory law enforcement behavior. Cops say they don't want to turn over info on Stingrays to public records requesters for "public safety" reasons, claiming it could compromise methods and techniques and allow criminals to stay out of their reach. They make the same claims in court when refusing to turn over information to defendants, which results in freshly-caught criminals being put back on the streets -- something that certainly doesn't make the public any safer.

Filed Under: canada, evidence, imsi catcher, mafia, montreal mafia, stingray