Appeals Court Says Warrantless Use Of Stingray Devices Probably OK

from the Seventh-Circuit-says-'Not-It!' dept

An interesting ruling [PDF] has been handed down by the Seventh Circuit Court of Appeals on the warrantless use of Stingray devices to locate individuals. Wisconsin police used an IMSI catcher to track down Damian Patrick for a parole violation. He was arrested while sitting in a car on a public street.

Multiple factors played into the court's decision, which found that using Stingrays without a warrant to locate people was not a Fourth Amendment violation. But it's not quite as simple as it might first appear to be. Complicating things were the circumstances of the arrest and arguments raised in Patrick's suppression request.

Patrick argued that the location tracking warrant (not a search warrant) was invalid. First, the tracking warrant made no mention of the Stingray the police used to locate him. Second, he argued that his personal location was not "contraband or the proceeds of a crime," making his location "off limits" to the Wisconsin PD's investigatory efforts. The court disagrees.

That sounds like an attempt to resurrect the “mere evidence” doctrine that the Supreme Court disapproved in Warden v. Hayden, 387 U.S. 294 (1967). Hayden authorized the use of warrants to get evidence to locate a wanted person. See also Steagald v. United States, 451 U.S. 204 (1981) (search warrant to enter house to look for person to arrest).

Police were entitled to use a warrant to obtain data that would help them track down Patrick’s location. Indeed, they were entitled to arrest him without a warrant of any kind, let alone the two warrants they had. United States v. Watson, 423 U.S. 411 (1976), holds that probable cause alone is enough for an arrest in a public place.

That statement, though, only refers to the arrest warrant. There's the matter of the location tracking warrant -- which only specified the use of "cell phone data," not a cell tower spoofer. That isn't addressed until later in the decision, but in terms of locating Patrick, the court feels his public location (parked on a city street) diminishes any expectation of privacy in his location. Once eliminated by the court's reasoning, it no longer matters what method the police used to locate him, at least according to the majority.

Probable cause to arrest Patrick predated the effort to locate him. From his perspective, it is all the same whether a paid informant, a jilted lover, police with binoculars, a bartender, a member of a rival gang, a spy trailing his car after it left his driveway, the phone company’s cell towers, or a device pretending to be a cell tower, provided location information. A fugitive cannot be picky about how he is run to ground. So it would be inappropriate to use the exclusionary rule, even if the police should have told the judge that they planned to use a cell-site simulator to execute the location warrant.

The appeals court never addresses whether or not the use of a Stingray constitutes a search. It weighs it against precedent in terms of call records and GPS tracking devices, and concludes that neither of those constitute a search either. (Although it does grant that the Supreme Court's Jones decision raises questions partially related to Stingray deployment -- like how long the device was in use and how precise the location data collected was.)

The government, however, conceded that it was a search ("for the purposes of this litigation"), but argued the lack of information about the device on the affidavit did not make the tracking warrant invalid. The court agrees and finds no reason to suppress the evidence. As it sees it, where Patrick was found is more important than how he was found. In the eyes of the majority, there was no privacy violation and Patrick doesn't have standing to challenge the government's search on these grounds.

We can imagine an argument that it will often be unreasonable to use a cell‐site simulator when phone company data could provide what’s needed, because simulators potentially reveal information about many persons other than the suspects. (The contrary argument is that data from simulators is current, while data relayed through phone companies’ bureaucracies may arrive after the suspect has gone elsewhere.) But if the problem with simulators is that they are too comprehensive, that would not lead to suppression—though it might create a right to damages by other persons whose interests were unreasonably invaded. Patrick is not entitled to invoke the rights of anyone else; suppression is proper only if the defendant’s own rights have been violated.

The court goes on to point out that no other appeals court has handled the issue of the constitutionality of Stingray searches… and that it's not interested in being the first to do so.

Questions about whether use of a simulator is a search, if so whether a warrant authorizing this method is essential, and whether in a particular situation a simulator is a reasonable means of executing a warrant, have yet to be addressed by any United States court of appeals. We think it best to withhold full analysis until these issues control the outcome of a concrete case.

The dissenting opinion, written by Chief Judge Diane Wood, runs far longer than the majority's opinion. Wood raises several questions about the assumptions made by the court. First, Wood points out the government has been willing to engage in very dubious practices just to keep the existence and use of Stingray devices secret.

This is the first court of appeals case to discuss the use of a cell‐site simulator, trade name “Stingray.” We know very little about the device, thanks mostly to the government’s refusal to divulge any information about it. Until recently, the government has gone so far as to dismiss cases and withdraw evidence rather than reveal that the technology was used.

Because of this, no one other than the law enforcement agents who deployed the device know exactly how it was operated and what it collected. The DOJ guidance quoted in the majority opinion does not provide any details on device usage or capabilities -- only that it has recommended the use of search warrants going forward by DOJ components. There is nothing in it that declares this guidance should be followed by local law enforcement agencies.

Wood points out that software packages for Stingray devices expand their capabilities significantly, allowing them to intercept communications as well as location data. Because the government on all levels refuses to discuss Stingray deployments, the court is left to assume all it did was scoop up location data. But that assumption may be incorrect, and if so, the government has zero interest in correcting the record.

In this case, the location warrant authorized only methods of fixing Patrick’s location that involved gathering information that would reveal his phone’s connection with cell‐ phone towers. The Supreme Court has recognized that a search of cellphone data requires a warrant. See Riley v. California, 134 S. Ct. 2473, 2494–95 (2014) The authorization of the collection of location data cannot be expanded to permit a search of the con‐ tents of Patrick’s cell phone. If the Stingray gathered information from the phone that went beyond his location, such a “search” of his phone would have been unauthorized, and suppression of the additional information (which might have pinpointed Patrick’s location) would likely be required.

Not only would the Supreme Court's Riley decision be implicated by this interception, but Title III (which controls wiretap use) would be as well. But, once again, the court is forced to assume the only thing collected was location data because that's all the government is willing to confirm. The government asserts that the Stingray collected nothing more than the same records it could have obtained without a warrant directly from service providers, albeit not in real time. However, there is seemingly no way to verify this as the government has refused to provide more details.

We are in all likelihood not looking at two interchangeable tools for gathering exactly the same information. If the facts ultimately show that the MPD had gathered the identical information in the same manner that Sprint would have used, I would concede that there is no problem. In such a case, the only difference between using the Stingray and obtaining the information from Sprint would be who gathered the information.

[...]

We do not know whether the warrant’s authorization of Sprint to “initiate a signal to determine the location of the subject’s mobile device on the service provider's network or with such other reference points as may be reasonable available” also describes the working of the Stingray that was used. If so, perhaps all is well. If the Stingray works in a different manner—for instance, by forcing the cell phone to transmit location data housed inside the cell phone rather than using a signal to locate the cell phone on the Sprint network—it might not.

The dissenting opinion also finds the majority's reasoning that the probable cause to arrest -- along with the defendant's public location -- excuses the lack of information in the warrant specifying the use of a Stingray device.

I recognize that Strieff contains language that could be stretched to suggest that a warrant’s existence, regardless of the actual causal chain, is sufficient attenuation. But elsewhere in the opinion the Court emphasized not only that the “warrant was valid” and “predated [the officer’s] investigation,” but also that it “was entirely unconnected with the stop,” and that the officer’s decision to arrest the defendant was “a ministerial act that was independently compelled by the pre‐existing warrant.”

Here, the use of the Stingray led to the arrest, and neither the arrest nor the search was a ministerial act.   It oversimplifies Strieff to focus solely on whether an intervening circumstance can be identified. That is important, but it is not enough by itself. Strieff, like all attenuation cases, also rests on two other factors: (1) the “temporal proximity” between the potentially unlawful action and the “search,” and (2) the culpability of the police misconduct. Id. As in Strieff, the relative temporal proximity in our case between the potentially illegal conduct and the search weighs against attenuation. But unlike the situation in Strieff, the facts here do not permit us to say that the MPD’s conduct was merely negligent: the police knew what they were doing. Purposeful evasion of judicial oversight of potentially illegal searches is exactly the kind of “police misconduct … most in need of deterrence.”

This decision is mostly a punt by the appeals court. It routes around most of the Fourth Amendment implications by relying heavily on the arrest warrant rather than the location warrant. The majority raises few challenges to the government's assertions about its Stingray use and obviously feels the issues it avoided dealing with here would be better dealt with anywhere but in its courtroom. While it is true there were any number of ways the police could have located Patrick, the fact is it used a Stingray device -- one it didn't disclose in its warrant request -- to do so. The decision to give the government a pass only encourages the culture of secrecy surrounding the use of cell tower spoofers.

Filed Under: 4th amendment, 7th circuit, imsi catcher, stingray, warrants

Judge Orders FBI To Turn Over Information On How Many People Around The World It Snagged With Its Playpen NIT

from the malware-whereabouts dept

This might be big, depending on how much of this information is passed on to the general public, rather than delivered ex parte or under seal. Joseph Cox of Vice/Motherboard was the first to snag this ruling [PDF] by a Washington district court judge ordering the FBI to turn over tons of info about the NIT it deployed in the Playpen child porn investigation.

As we're already aware, the NIT was deployed by the FBI in Virginia but obtained identifying information about Tor-cloaked site visitors not just all over this country, but all over the world. The motion to compel discovery asked for several details about the NIT and its deployment and most of them have been granted.

Here's the full list (with additional commentary):

1. All records related to the Government’s review and approval of Operation Pacifier.

The Court has taken this discovery request under advisement. An order is soon forthcoming.

2. Copies of any reports made to the National Center for Missing and Exploited Children (NCMEC) regarding child pornography posted on the Playpen web site.

Defendants’ motions are granted.

3. Copies of any notifications that were sent to victims by the Government for obtaining restitution related to images that were posted on, or distributed from, the Playpen web site.

Defendants’ motions are granted.

4. The number of new images and videos (i.e. content not previously identified by NCMEC) that was posted on the site between February 20, 2015 and March 5, 2015.

Defendants’ motions are granted.

(This information -- whether or not actually useful in suppression motions -- should at least provide some insight into how much additional child porn made its way to site visitors as a result of the FBI's decision to seize [and act as administrators of] the server, rather than shut it down. Information obtained in other court cases suggests the FBI not only acted as hosts during the NIT deployment, but actually made the site faster and more responsive.)

5. The names of all agents, contractors or other personnel who assisted with relocating, maintaining and operating Playpen while it was under Government control.

Defendants’ motions are granted.

6. Copies of all notes, emails, reports, postings, etc. related to the maintenance, administration and operation of Playpen between February 20, 2015 and March 5, 2015.

Defendants’ motions are granted.

(Again, this info could confirm whether or not the FBI improved the child porn site's performance during its two-week turn as administrators, as well as provide additional insight into how much child porn distribution was aided and abetted by the agency.)

7. Copies of all legal memoranda, emails and other documents related to the legality of the FBI’s operation of Playpen (and the distribution of child pornography by the Government), including requests for agency/departmental approvals of the undercover operation of Playpen and any communications with Main Justice or the Office of General Counsel at the FBI.

The Court has taken this discovery request under advisement. An order is soon forthcoming.

(This would be the government's legal rationale for running a child porn site rather than shutting it down. Chances are this will remain under seal and is probably FOIA-proof, as most legal guidance documents are.)

8. Copies of all correspondence, referrals and other records indicating whether the exploit used in the Playpen operation has been submitted by the FBI or any other agency to the White House’s Vulnerability Equities Process (VEP) and what, if any, decision was made by the VEP.

The Court has taken this discovery request under advisement. An order is soon forthcoming.

(Little is known about the government's actual handling of the VEP. On one hand, we have public statements which pay lip service to not screwing US companies by hoarding vulnerabilities. On the other hand, we have the exact opposite in practice.)

9. Copies of invoices and other documents for the hosting facility/facilities where the Government operated the Playpen server, the server from which the Government delivered the NIT malware and the server that NIT targets sent their identifying information back to, including documents revealing whether the Government informed the hosting provider(s) that child pornography would be stored in their facility or transmitted over their networks.

Defendants’ motions are granted. To the extent that the Playpen hosting provider was the Government, not a private party, it appears there may not be much discovery responsive to this request.

(There may be nothing here. Or there could be third party hosts involved who were never informed about their participation in the FBI's sting operation. If so, fun times ahead for the US government.)

10. The number of Playpen-related investigations that have been initiated but did not result in criminal charges, beyond the approximately 200 cases now pending across the country.

Defendants’ motions are granted.

(Another can of worms the FBI would probably like to remain closed. According to the government's own arguments in these cases, users would have connected to the site for a single purpose: to engage in criminal activity. A lack of charges would be a surprise and somewhat undermine the government's assertions about the criminal intent of visitors to the site.)

11. The total number of IP addresses and MAC IDs that were seized during the time the FBI was operating Playpen, over and above those related to these approximately 200 pending cases.

Defendants’ motions are granted.

12. The number of IP addresses and MAC IDs obtained during the investigation from foreign computers and the countries in which this data was obtained.

Defendants’ motions are granted.

(These are the potential goldmine. This will show how far-flung the FBI's net actually was, as well as provide more ammo for suppression motions predicated on Rule 41 jurisdictional limitations. The FBI is well aware it can't perform searches outside the jurisdiction covered by the warrant, but it chose to do so anyway. So far, its evidence has mostly held up, thanks to courts deciding suppression isn't the correct remedy, or crediting the FBI for unearned "good faith." The FBI and DOJ are pushing for changes to Rule 41 that eliminate the jurisdictional limits, so it's disingenuous for the agency to claim its agents acted in good faith when securing the warrant.)

This now becomes the Playpen case to watch, even if most of this information is likely to remain in the hands of defense lawyers only. Dismissal and suppression motions will contain references to the content of these documents, however, which will shed more light on the FBI's NIT deployment and its child porn site administration.

Filed Under: doj, eavesdropping, fbi, malware, nit, playpen, rule 41, warrants

Researchers Ask Court To Unseal Documents Related To Technical Assistance Requests And Electronic Surveillance Warrants

from the great-unsealing-continues dept

This has the makings of a movement along the lines of the highly-unofficial "Magistrates Revolt." More efforts are being made more frequently to push federal courts out of their default secrecy mode. The government prefers to do a lot of its work under the cover of judicial darkness, asking for dockets and documents to be sealed in a large percentage of its criminal cases.

Just in the last month, we've seen the ACLU petition the court to unseal dockets related to the FBI's takedown of Freedom Hosting using a Tor exploit and Judge Beryl Howell grant FOIA enthusiast Jason Leopold's request to have a large number of 2012 pen register cases unsealed.

Now, we have researchers Jennifer Granick and Riana Pfefferkorn petitioning [PDF] the Northern District of California court to unseal documents related to "technical assistance" cases -- like the one involving the DOJ's attempted use of an All Writs Order to force Apple to crack open a phone for it.

Petitioners Jennifer Granick and Riana Pfefferkorn, researchers at the Stanford Center for Internet and Society proceeding pro se, file this Petition to unseal court records. We file this Petition so that the public may better understand how government agents are using legal authorities to compel companies to assist them in decrypting or otherwise accessing private data subject to surveillance orders. Petitioners hereby seek the docketing of surveillance orders issued by this Court; the unsealing of those dockets; and the unsealing of the underlying Court records in surveillance cases relating to technical-assistance orders issued by this Court to communications service providers, smartphone manufacturers, or other third parties…

This district should contain a great number of documents fitting this description, seeing as it also contains a great number of service providers and third party tech companies.

More specifically, the researchers are looking to gain access to documents in cases where the government has used the following list of statutes to compel cooperation:

• the Wiretap Act, 18 U.S.C. §§ 2510-2522;
• the Stored Communications Act (or “SCA”), 18 U.S.C. §§ 2701-2712;
• the Pen Register Act (or “Pen/Trap Act”), 18 U.S.C. §§ 3121-3127; and/or
• the All Writs Act (or “AWA”), 28 U.S.C. § 1651

Not only that, but Granick and Pfefferkorn are asking the court to shift away from the default secrecy that has made this petition necessary.

[Petitioners request that] the Court revise its practices going forward, such that the Clerk’s office will assign case numbers to, docket, and enter into CM/ECF all applications and orders for search warrants, surveillance, and technical assistance; the Court will undertake a periodic review (e.g., annually or biannually) of sealed dockets, warrants, surveillance orders, and technical-assistance orders; and after such review, the Court will unseal those records for which there is no longer any need for continued sealing.

The researchers point out that secrecy in court records is a First Amendment issue: these documents were meant to be accessible by the general public. They also note that they aren't asking for anything related to ongoing investigations or information that might compromise future investigations -- like names of law enforcement personnel or other potential criminal investigation targets. All they're asking is that the court stop granting the government permission to seal complete dockets so often and to perform periodic reviews of sealed cases to see whether the imposed secrecy is still warranted.

As it stands now, this large number of sealed documents prevents the public from knowing how law enforcement agencies and courts are interpreting (often outdated) tech-related laws. It's preventing researchers like these two from gaining any insight on the government's electronic surveillance efforts and it's locking defense lawyers out of possibly precedential rulings that may affect current or future clients.

Filed Under: all writs act, electronic surveillance, jennifer granick, riana pfefferkorn, technical assistance, warrants

Even NSA BFF Verizon Thinks Warrantless Location Data Collection May Have Gone Too Far

from the bridge-too-far dept

You'd be hard pressed to find companies more bone-grafted to the nation's intelligence gathering apparatus than AT&T and Verizon. So much so that it's often difficult to determine where the government ends, and where the telecom duopoly begins. From Mark Klein highlighting how AT&T was giving the NSA live access to every shred of data that touched the AT&T network, to Snowden's revelation of Verizon's handover of customer metadata, these are companies that were not only eager to tap dance around privacy and surveillance law, but actively mocked companies that actually stood up for consumer privacy.

That's why it's notable to see one of Verizon's top lawyers, Craig Silliman, penning an op-ed over at Bloomberg implying that location data hoovering has jumped the shark. Silliman details the problems arising in the age of location data collection, and specifically how four recent district courts have ruled that law enforcement can get location data without a warrant. These rulings relied on the "third-party doctrine," or the argument that consumers lose privacy protections to this information if they're willing to share it with a third party -- aka Verizon.

But Silliman notes that the cases in question leaned on data collection and networks from 2010 and 2011, before the rise of even more precise small cell (femto) technology, deployed in many areas to shore up tower coverage gaps:

A femto cell may have a cell radius of between 100 feet and 500 feet. Knowing that an individual’s cellphone is within a few hundred feet of a cell obviously is more precise than knowing that it is within a few miles. All of these changes – particularly, the surge in our customers’ use of data and the fact that many of today’s cell sites have smaller ranges – mean that our network now collects more voluminous and more precise location information than when, in 2010 and 2011, law enforcement obtained the location information that gave rise to the four appellate cases described earlier.

Silliman proceeds to note that he hopes that should these cases stumble toward the Supreme Court, the court will realize the game has changed dramatically in the last half decade:

The defendants in the two location information cases that were decided this Spring are asking the Supreme Court to review their cases and the third-party doctrine. I think it’s a matter of time before the Court takes a case like this and when it does, I hope that it takes into account how quickly technology — including the volume and precision of location information — is changing.

Verizon tells The Intercept that while the op-ed comes on the heels of the recent surveillance scandal at Yahoo (soon to be owned by Verizon), the two are not related, and Silliman's editorial was penned weeks before the news of Yahoo's e-mail searches surfaced. Silliman claims that Verizon's motivation here is just an interest in protecting consumer privacy as it collects this data for troubleshooting (and, of course, sale):

Like other carriers, Verizon retains this information to troubleshoot, maximize network efficiency, and for other business purposes. We keep cell site and sector information that we need for these business purposes for one year, while we keep other location information, like multiple location points collected during a data session and the approximate distance a device is from a cell site for eight days.

We take our customers’ privacy very seriously, of course, and protect this information carefully.

Well, let's not go that far. This is the same company that was caught covertly modifying user data packets to track their behavior around the internet, failing to inform customers this was happening or provide working opt-out tools. Verizon's also actively working to prevent new privacy protections for consumers at the FCC. And again, this is the same company that, hand in hand with AT&T, consistently went above and beyond in handing over vast oceans of data to intelligence services while never challenging the government and actively mocking companies that did.

That said, it's still amazing to see one of the government's closest allies on domestic surveillance suggesting that just maybe we've taken this whole warrantless hoovering of information thing a little too far.

Filed Under: craig silliman, data collection, law enforcement, surveillance, warrants
Companies: verizon

Court Shuts Down Argument That Warrantless Seizures Of Cell Phones Is Fine Because Criminals Use Cell Phones

from the criminals-are-also-know-to-use-cash,-carry-wallets dept

The Boston Police Department advanced a rather novel legal theory in court recently: because criminals are known to use [common item X], [common item X] can be seized without a warrant. Insert any item into that equation and see what it gets you.

The specifics of the case don't make the theory any less dubious. In this case, the item was a phone owned by a high school student. An investigation of a robbery that resulted in the death of a store clerk resulted in BPD investigators believing the student might be a suspect. From the opinion [PDF] (h/t Brad Heath):

The following day, February 24, 2010, the defendant arrived late to his high school. Pursuant to the school's usual practice for all arriving students, he was searched and his "pay-as-you-go" Samsung/Sprint cellular telephone, equipped with a camera, was confiscated. That afternoon, a detective investigating the robbery-homicide met with one of the school's administrators. The administrator told the detective that the defendant had become "agitated" earlier that day and had left the school without picking up his cellular telephone. The detective notified a supervisor that the school was holding the defendant's telephone. \

Neither the detective nor the supervisor had, at that point, any information that a cellular telephone contained evidence of the robbery and shooting, but they were aware, based on their experience, that such devices often contained useful information in cases involving multiple perpetrators. The supervisor instructed the detective to seize the device without a warrant apparently on the basis of his belief that, if the defendant retrieved the device before a warrant could be obtained, he would destroy the device or erase relevant evidence. Thereafter, the device was transported to the police station, where it was logged as evidence and placed in a special bag designed "to prevent remote intrusion." Police did not search the device.

The fact that the phone could have been retrieved by the student and any evidence on it destroyed was the "exigent circumstances" used to justify the seizure. The phone actually sat around in the evidence locker for 68 days before it was searched. However, the "exigent circumstances" argument failed to salvage the warrantless seizure because the state argued it was allowed to seize anything that could conceivably be used by criminals.

Here, prior to seizing the defendant's cellular telephone, police had received information that the robbery and homicide under investigation had been committed by several people, that the defendant likely was one of those people, and that he owned a cellular telephone. They also knew from experience that coventurers often use cellular telephones to communicate with each other, and that these devices may contain evidence of such communications. According to their own statements, however, the detectives here did not have any "information that [a] cell phone was used in the crime under investigation," nor did they claim that there existed a particular piece of evidence likely to be found on such a device. In essence, then, their decision to seize the defendant's cellular telephone was made because (a) they had reason to believe that the defendant had participated with others in the commission of a robbery-homicide and (b) their training and experience in cases involving multiple defendants suggested that the device in question was likely to contain evidence relevant to those offenses.

The shorter version of this legal theory:

A criminal act was committed. Criminals often use cell phones to communicate and/or document their criminal acts. Therefore, any phone can be seized and held without establishing probable cause for the seizure. Just in case.

The court isn't interested in entertaining law enforcement's assertion that it should be able to seize electronic devices speculatively.

In essence, the Commonwealth is suggesting that there exists a nexus between a suspect's criminal acts and his or her cellular telephone whenever there is probable cause that the suspect was involved in an offense, accompanied by an officer's averment that, given the type of crime under investigation, the device likely would contain evidence. If this were sufficient, however, it would be a rare case where probable cause to charge someone with a crime would not open the person's cellular telephone to seizure and subsequent search.

Noting the Supreme Court's Riley decision, as well as other cases relevant to this search and seizure of cell phones, the state court finds that allowing this argument to salvage the warrantless seizure would turn the Fourth Amendment into a meaningless pile of words.

We cannot accept such a result, which is inconsistent with our admonition that "individuals have significant privacy interests at stake in their [cellular telephones] and that the probable cause requirement . . . under both the Fourth Amendment . . . and art. 14 . . . [must] serve[] to protect these interests." '

Furthermore, it finds that the 68-day gap between the seizure and search was unreasonable. The state argued that the investigation was "complex," but the court points out investigators obtained five other search warrants during that same time period.

Even if it had been more timely in its acquisition of a warrant, that still wouldn't have been able to rescue the evidence it located on the suspect's phone. Because the underlying seizure was performed without probable cause, the use of a warrant for the search did nothing but create a paper trail for "poisoned fruit."

Hopefully this reversal will deter future seizure attempts by state and local law enforcement. Without the ruling in place, anything from cars to computers could end up being taken and held by police under the assumption that criminals use such items. That's not probable cause. That's not even reasonable suspicion. It's fishing expeditions waiting to happen and speculation taking precedent over Fourth Amendment protections.

Filed Under: 4th amendment, criminals, mobile phones, search, warrants

Judge Overturns Denied Email Search Warrant, Says Gov't Can Get It All, Dig Through It Later

from the the-particularity-of-'every-email-in-the-account' dept

The "Magistrate's Revolt" was fun while it lasted. Post-Snowden, a few magistrate judges began viewing law enforcement's electronic search warrant applications with a bit more skepticism. These judges also rolled back a bit of the deference extended to the federal government, forcing the DOJ to narrow search requests or drop gag orders.

The first flames of the revolt to be snuffed out occurred in a DC district court -- the same district where "In re Sealed Case" is the most common docket entry -- when Judge Richard Roberts overrode two decisions by magistrate judge John Facciola. The deference to "government knows best" was reinstated and the feds got their gag order and broad search requests approved.

The same thing is happening in the center of the country. Orin Kerr of the Volokh Conspiracy reports that a Kansas district court judge has reversed magistrate judge David Waxse's denial of an email search warrant.

In March, Waxse handed down a decision rejecting a warrant to search several Hotmail email accounts on the ground that the two-step procedure used to execute email warrants violated the Fourth Amendment. Under the procedure, the warrant orders the service provider to hand over the entire account; the government then searches the entire account for the information sought in the warrant. Echoing his decision from 2015 about cellphone searches, Waxse held in March that this two-step procedure violates the Fourth Amendment particularity requirement unless the government includes a sufficient set of ex ante search protocols guiding the warrant.

So much for that. Kansas district judge Carlos Murguia has decided [PDF] that a request for the entire contents of an email account is "sufficiently particular."

In applying the law to the warrant at issue, this court concludes it was clearly erroneous or contrary to law for Judge Waxse to find it was not sufficiently particular. The warrant application identified with specificity the target email accounts to be searched and the evidence to be seized in connection with violations of 18 U.S.C. §§ 371 (conspiracy), 1029 (access device fraud), 1030 (computer intrusion), 1343 (wire fraud), and 2319 (copyright infringement), all occurring since September 7, 2008. The government stated with specificity the exact information it sought, thus leaving officers with little discretion to go outside the scope of the warrant. The application also included an affidavit detailing the criminal scheme and explaining the relevance of the evidence to the investigation. Rule 41(e)(2) authorizes the “seize first, search second” two-step process, thus allowing the government to obtain all of the data to later search for relevant evidence. And while Rule 41(e)(2) leaves open the question of particularity when the government seeks ESI, the majority of case law relating to the search of an email account has upheld the Government’s ability to obtain the entirety of the account to then search for relevant evidence. Based on the current state of the law, this court finds Judge Waxse’s decision regarding particularity was clearly erroneous or contrary to law.

The district court judge finds the government's affidavit is lacking in probable cause, which means the government won't get to use this particular warrant, but it will no longer have to battle Judge Waxse in the future for permission to grab everything.

Judge Murguia also looked at various ex ante search restrictions Waxse suggested and basically says it's up to the government to decide whether or not to incorporate these.

Although Judge Waxse included many options in his order, these were simply suggestions for the government in the future, not court-ordered ex ante instructions for the issuance of this specific warrant. Had Judge Waxse, for example, provisionally granted the warrant under the premise the government would submit a search protocol, or had he granted the warrant but ordered the use of a special master to search the data seized from the Provider, this court could then review those court-ordered ex ante limitations for reasonableness. Because no ex ante instructions were ordered, this court has nothing to review, and to comment on the reasonableness of each suggested limitation would result in this court issuing an advisory opinion.

Presumably the government will continue to operate without the suggested restrictions. The door isn't shut on magistrates imposing further restrictions on granted searches, but chances are these will be removed by sympathetic judges at the district level.

That being said, Judge Murguia isn't completely blind to the implications of "seize first, search later" warrants.

This court first acknowledges Judge Waxse’s concern with properly balancing an individual’s right to privacy with the government’s ability to effectively prosecute criminals. The digital storage era has caused a need for courts to reevaluate well-established Fourth Amendment standards.

Unfortunately, that reevaluation will have to wait for another day… and another challenge more specifically suited to address the issue at hand.

Filed Under: 4th amendment, search, warrants

ACLU Challenges Gag Orders Issued To Tech Companies By The DOJ

from the hey,-we-notified-SOMEBODY...-that-counts-for-something dept

The ACLU is hoping to intervene in Microsoft's legal battle against the government, challenging gag orders attached to warrants and subpoenas issued under the Electronic Communications Privacy Act (ECPA). Microsoft sued the DOJ back in April, arguing for the right to notify customers that their communications and data have been handed over to the government.

Microsoft didn't have a problem with the government's gag orders in every case. It's just that the demand for secrecy accompanied more than half of the ~300 orders per month Microsoft receives. And nearly 70% of those gag orders arrived with no fixed end date.

The ACLU petitioned the court to intervene in the case on its own behalf, citing its position as a Microsoft customer. The DOJ filed a motion to dismiss Microsoft's lawsuit, hoping the court will find Microsoft has no standing to challenge gag orders on its customers' behalf. The ACLU is trying to prevent this from happening until the DOJ addresses the issues raised by the ACLU's (attempted) intervention. In its opposition [PDF] to the DOJ's motion, the ACLU points out that the government's "no standing" argument pretty much nullifies any sort of due process for Microsoft customers (including the ACLU) who've been targeted by the DOJ's super-secret warrants, relegating them to a Kafka-esque legal purgatory.

The government attempts to insulate its refusal to provide notice from judicial review, arguing that neither Microsoft nor the ACLU has standing to raise these important constitutional questions. By the government’s logic, Microsoft does not ever have standing to defend its customers’ right to notice, and Microsoft’s customers, including the ACLU, may not defend their own right to notice until after they receive the primary relief they would seek—that is, notice. In the government’s view, the only plaintiffs who have standing to sue for notice are those who have already gotten it, and those deprived of notice forever have no ability to seek a remedy at all. That is not the law.

The hope here is to not only find the open-ended gag orders unconstitutional, but also the law granting this secrecy -- the ECPA -- unconstitutional as well. The shift from physical "papers" to digital files was addressed by legislators in the worst way possible. The ECPA did away with the notification requirement attached to searches of physical places. When a home or business is searched, the owner or resident is served with a warrant. For electronic communications, a third party is approached. Legislators apparently felt as long as someone was notified, that was good enough -- even if that someone isn't the target of the search warrant.

That's basically the government's argument: notice is served to the site of intrusion. If the affected parties don't actually reside there (but their "papers" do), too bad.

The government’s argument conflates a historical anachronism with a constitutional principle. The government is correct that officers traditionally provided Fourth Amendment notice at the physical site of the intrusion. But that is so because, for the first 175 years of the Fourth Amendment’s application, it was understood to cover primarily physical trespasses. See Katz, 389 U.S. at 353. As a result, notice provided at the site of the intrusion was notice to the individual whose Fourth Amendment rights were at stake. It is no surprise, therefore, that Federal Rule of Criminal Procedure 41 reflects that historical context. Under Rule 41(f), an officer executing a warrant must “give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.”

The ECPA is the DOJ's argument committed to paper. Notice only needs to be provided to the third party where communications and documents are held. To ensure the party whose documents/communications are being taken is kept out of the loop, the DOJ takes the wording of the law to heart and ignores the intent behind the Fourth Amendment protections granted to citizens.

The ECPA does not require the government to provide notice when it relies on a warrant, and so the government now routinely searches and seizes individuals’ electronic communications without providing any notice—delayed or otherwise—to those whose private information it has obtained. According to Microsoft’s Complaint, nearly half of the federal demands it has received under ECPA in the last eighteen months were accompanied by gag orders, the majority of which contained no time limit. Accordingly, a substantial portion of the individuals whose electronic communications the government demands from Microsoft receive no notice whatsoever, from either the government or Microsoft.

The law undercuts the Fourth Amendment by preventing those affected from challenging the lawfulness of the search or seeking redress through the judicial system for violations. Gag orders that run indefinitely allow the government to avoid being held accountable for any wrongdoing. In addition, the service of warrants to third parties is done without any meaningful oversight, putting the DOJ in the position of policing itself -- something it does with no particular enthusiasm or effectiveness.

Filed Under: doj, ecpa, gag order, standing, subpoena, surveillance, warrants
Companies: aclu, microsoft

If You're Learning About It From Slate, Running Your Own Email Server Is A Horrendously Bad Idea

from the don't-do-this dept

So, Slate has a weird article by Nat Meysenburg suggesting that everyday people should run their own email servers. He admits up front that he doesn't think Hillary Clinton should have run her own email server, but for lots of other people he declares it to be "a good idea."

For years, I’ve been trying to convince people that there is value in having an email server in your closet. But few seemed to really get it, so I often found myself wishing for a high-profile example to illustrate why it is a good idea. That wish has, in a way, come true: The casual news consumer has had the pleasure of hearing about a “private email server” quite a lot over the past year.

Except, beyond that, he's basically wrong. Yes, if you're really technologically savvy and want to do it, you can absolutely run your own email server. Though, honestly, it's probably going to be kind of a pain, because you'll need to constantly be patching it and protecting it, and even then it will probably be significantly less secure than if you use an online provider. Meysenberg is right on only one point, barely, and it's that if you run your own email server, and the government wants to get access to it, at least you'll know about it:

When your emails reside on a cloud provider’s server, the owners of that server are ultimately who decide when to let the government, or any other party, access those emails. In the case of your work’s server, those choices are made by your employer. In the case of Gmail (or any other cloud provider), this choice is typically made by the company’s legal team, based on its evaluation of the government’s demands. Most of the big companies, including Google, do have a policy of notifying users about demands before they hand over the requested data, which would give you an opportunity to assert your rights in court. However, there are many cases in which the government’s demand will be accompanied by a gag order forbidding the company from providing that notice.

And, thus, he notes:

Having a private server in your home side steps these uncertainties. At home you as a private individual have the ability determine who has access to your email inbox—just like you have a right to determine who has access to that box of old love letters from high school. By owning the server, all requests for data have to go through you (and/or your lawyers), and any confiscation of the physical hard drives on which your emails are stored requires a search warrant for your home. And unlike with email stored in the cloud, it will always be obvious if and when the police seize your email server.

But, of course, none of that stops the government from getting your server if they want it... it's just that in this one case you'll know about it.

And for what tradeoff? Well, there are some pretty big ones. If you're not particularly skilled and experienced with online security issues, your personal email server is almost certainly significantly less secure than the big companies that have strong security teams and are constantly making it stronger and on the lookout for attacks. If you're that good, you're not learning about the issue of hosting your own email server for the first time in... Slate.

The article insists that it's a myth that running your own server is a security nightmare, but I've yet to see an online security expert who agrees with that even remotely. Even the comments to the Slate piece are filled with IT folks screaming about what a bad idea this is.

In the end, this seems to be an issue of tradeoffs and skills. If you're quite skilled with online security and you think the government might want secret access to your email, then maybe in some limited cases, it might make more sense for you to run your own server -- though, even then you're exposing yourself to being hacked by the government too, because, you know, they do that kind of thing also in some cases. Otherwise, you're almost certainly opening yourself up to a home IT nightmare and a lot more trouble than it's worth for significantly less security.

In short, even if you're not Hillary Clinton, running your own email server is a bad idea. And if you're just now getting the idea from Slate... then it's a really bad idea.

Filed Under: email, email server, privacy, security, warrants

Federal Judge Says Real-Time Cell Location Info -- Whether Obtained With A Stingray Or Not -- Requires The Use Of A Warrant

from the no-more-pen-register-orders dept

An interesting decision by a federal judge in Florida suggests this district, at least, may not be amenable to the warrantless use of Stingray devices… or any other method that harvests cell site location data in real time.

Although the defendants lost their motions to suppress due to a lack of standing, the judge had this to say about the acquisition of cell site location info in this case. (via FourthAmendment.com)

Here, I agree with the Defendants that law enforcement's seizure of precise realtime location information by surreptitiously monitoring signals from the cell phones in this manner is a search subject to the proscriptions of the Fourth Amendment. Such is the express conclusion of the Florida Supreme Court and the conclusion suggested by the Supreme Court. See Tracey v. Florida, 152 So.3d 504 (Fla. 2014); United States v. Jones, 132 S.Ct. 945 (2012). As such, law enforcement should have obtained a search warrant issued upon probable cause. The Government concedes that the practice in this Court requires a warrant based upon probable cause for such searches and that the these pen/trap applications did not establish probable cause.

Originally, the defense claimed police used a Stingray to track five burner phones used by the defendants. This seemed to be the most logical conclusion, considering how closely and immediately the location data was acquired. But the government responded that no cell site simulators were used to track the devices. Instead, another tool that has long been available to law enforcement was deployed -- a tool created explicitly for law enforcement use by the cell provider.

On July 21, 2016, the Court heard argument of counsel and took testimony from Detective Joseph Petta, the co-affiant on each of the applications at issue. In short, Detective Petta testified that law enforcement obtained pen/trap authorizations for the cell phone numbers at issue in order to obtain precise realtime location information that was used to track the whereabouts of these phones, to identify those associated with Defendants, and to identify locations of interests. He denies use of a Stingray or similar device, but acknowledges that he used a website offered to law enforcement by Sprint (the "L-site") to obtain such information. Such realtime information was available every fifteen minutes twenty-four hours a day. He further acknowledges that law enforcement used the realtime information to track the cellular phones, which they believed were used by this group. By his account, such applications were the usual way to obtain such realtime location information at the time these applications were submitted.

[...]

According to Detective Petta, the website allows law enforcement to log on and obtain realtime or contemporaneous and highly precise longitudinal and latitudinal information linked to GoogleMaps. A spreadsheet of all such location data is made available to law enforcement. Detective Petta testified that the pen/trap orders were not used for any other purpose than to obtain the realtime location of the cell phones.

The information returned from L-site queries is likely not as timely or precise as a roving Stingray but can achieve the same objectives. (An example of L-site data can be seen here.) Sprint has made this tool available for law enforcement to use since at least 2009, tracking roughly with the rise in Stingray use by police departments. The difference here is any law enforcement agency can obtain this data, which opens the market to those who don't have these devices yet or a warrant requirement they'd rather work around. Obviously, this also aids those deploying parallel construction to keep Stingray use hidden.

Either way, the court doesn't agree with the government's assertion that a pen register order is sufficient for obtaining real-time cell site location info. The order cites the Supreme Court's US v. Jones decision in support of its determination that real-time location tracking is a search and requires the use of a warrant -- something the original decision failed to state quite as explicitly. (It only found that placing a GPS device on a vehicle is a search under the Fourth Amendment. The issue of real-time location tracking remained mostly unaddressed.)

But while this order may alter law enforcement's tactics (and even the government admits it should have acquired a warrant in light of other Florida district decisions), it does nothing for the two defendants. An expectation of privacy in real-time location data doesn't help two defendants with a handful of burner phones they're reluctant to claim as their own. The absence of any link between the tracked phones and the defendants means they have no standing to challenge the search.

Defendants here have asserted no claim to or interest in the cell phones at issue. The cell phones were not registered in Defendants' names, and Defendants presented no evidence regarding their possession, use, or control of the phones. Instead, Defendants rely solely upon loose allegations in the pen/trap applications submitted by the Government, which suggested a link between the cell phones and Defendants in conclusory, unsupported fashion. In the circumstances and in the absence of contrary case law, I am obliged to conclude that they fail to establish standing to contest the searches at issue and the motions to suppress should be denied.

A lack of standing tends to be fatal to motions to suppress. But the disavowal of ownership does shift the burden of proof back on the government, which makes it a little harder to prove the burner phones actually belonged to the defendants found carrying them. The court notes the "loose allegations" contained in the pen register applications are "conclusory" and "unsupported," which seems to indicate the government has a few more hurdles to overcome before it can tie the defendants to the phones they're not willing to claim.

Filed Under: 4th amendment, csli, imsi catcher, location info, stingray, warrants

Botnet Bill Could Give FBI Permission To Take Warrantless Peeks At The Contents Of People's Computers

from the mind-if-we-take-a-look-around,-they-asked-never dept

In a recent ruling in a child porn investigation case, a judge declared that the FBI's Network Investigative Technique (NIT) -- which sent identifying user info from the suspect's computer to the FBI -- was the equivalent of a passing cop peering through broken blinds into a house.

[I]n Minnesota v. Carter, the Supreme Court considered whether a police officer who peered through a gap in a home's closed blinds conducted a search in violation of the Fourth Amendment. 525 U.S. 83, 85 (1998). Although the Court did not reach this question, id at 91, Justice Breyer in concurrence determined that the officer's observation did not violate the respondents' Fourth Amendment rights. Id at 103 (Breyer, J., concurring). Justice Breyer noted that the "precautions that the apartment's dwellers took to maintain their privacy would have failed in respect to an ordinary passerby standing" where the police officer stood.

What would normally be awarded an expectation of privacy under the Fourth Amendment becomes subject to the "plain view" warrant exception. If a passerby could see into the house via the broken blinds, there's nothing to prevent law enforcement from enjoying the same view -- and acting on it with a warrantless search.

Of course, in this analogy, the NIT -- sent from an FBI-controlled server to unsuspecting users' computers -- is the equivalent of a law enforcement officer first entering the house to break the blinds and then claiming he saw something through the busted slats.

The DOJ may be headed into the business of breaking blinds in bulk. Innocuous-sounding legislation that would allow the FBI to shut down botnets contains some serious privacy implications.

Senators Whitehouse (D-RI), Graham (R-SC), and Blumenthal (D-CT) introduced the Botnet Prevention Act in May, which (among other things) amends the portion of federal law (18 U.S.C. § 1345) that authorizes these injunctions. The bill would expand § 1345 by adding violations of a section of the Computer Fraud and Abuse Act (“CFAA”) that covers botnets (and more) to the list of offenses that trigger the DOJ’s ability to get an injunction.

More specifically, it would allow injunctions in all violations or attempted violations of subsection (a)(5) of the CFAA that result or could result in damage to 100 or more computers in a year, including any case involving the “impair[ment of] the availability or integrity of the protected computers without authorization,” or the “install[ation] or maintain[nance of] control over malicious software on the protected computers” that “caused or would cause damage” to the protected computers.

It only sounds like a good idea: the government riding to the rescue of unaware computer users whose devices have been pressed into service by malware purveyors and criminals. But, as Gabe Rottman of CDT points out, there's some vague wording in the existing law that would undercut important Fourth Amendment protections when used in conjunction with the DOJ's botnet-fighting powers.

Buried deep within § 1345(b) is a single phrase that could open up a number of thorny issues when this injunctive authority is applied to botnets. The section not only allows the government to obtain a restraining order that stops someone from doing something nefarious, but also an order that directs someone to “take such other action, as is warranted to prevent a continuing and substantial injury . . . .”'

Rottman points to the FBI's 2011 shutdown of the Coreflood botnet. After obtaining a restraining order under the federal rule, the FBI used its own server to issue commands to infected computers, halting further spread of the malware and shutting down the software on infected host devices. Again, this seems like a good use of the government's resources until you take a closer look at what's actually happening when the FBI does this sort of thing.

The court hearing the Coreflood case accepted the government’s argument that the “community caretaker” doctrine allowed the transmission of the shutdown order, as the action was “totally divorced from the detection, investigation, or acquisition of evidence relating to the violation of a criminal statute.” At the time, the government likened its actions to a police officer who, while responding to a break-in, finds the door to a house open or ajar and then closes it to secure the premises.

The "community caretaker" function is one exception to warrant requirements. Accessing peoples' computers without their permission under these auspices allows the FBI to avail itself of a second warrant exception.

In order to scrub private computers for malware, the government would, by necessity, have to search the computer and its contents for the malware. Once the door is ajar, rather than closing it, the police would actually “walk in” to the computer. And anything they find in “plain view” can be used as evidence of a crime. Nothing in the current version of the bill would prevent such a search or collection, giving the government the potential means to search countless computers of victims of the botnet (not the perpetrators) without a warrant.

While these are both valid exceptions to warrant requirements, they've never been deployed on this sort of scale. Officers can perform community caretaker functions that may result in contraband being discovered in plain view. When the FBI takes on a botnet, however, it will have access to potentially thousands of computers at a time and the legislated permission to not only "enter" these computers, but to take a look around at the contents.

The Fourth Amendment was put into place to end the practice of general warrants. The FBI's botnet-fighting efforts turn court-ordered injunctions into digital general warrants, only without the pesky "warrant" part of the phrase. And, unlike other warrants, the proposed legislation would do away with another Fourth Amendment nicety: notification.

As CDT noted in its comments on the Rule 41 change mentioned above, potentially as many as a third of computers in the United States are infected with some form of malware. And, botnets are extremely hard to clean up, especially when you depend on victims to voluntarily submit their computers for cleaning. Given this reality, unless notice is required by statute, law enforcement would have an incentive to dispense with notice in the much wider array of shutdowns permitted under the Graham-Whitehouse bill.

The bill has only been introduced and there's no forward motion as of yet. It's in need of serious repair before it heads further up the legislative chain. As it's written, there's nothing standing between people's personal files and a host of digital officers wandering through virtual houses in search of malware and searching/seizing anything else that catches their eye.

Filed Under: botnet, botnet prevention act, congress, fbi, hacking, lindsey graham, richard blumenthal, sheldon whitehouse, warrants