Legislators Looking To Ban Geofence/Reverse Warrants In The State Of New York

from the illegalize-it dept

A report published by Google's transparency team last August made it clear reverse warrants weren't a law enforcement fad, but rather a trend. Google is the recipient of pretty much every so-called reverse (or geofence) warrant issued, thanks to its vast stores of location info. When cops have a crime but no likely suspect, they have the option of turning everyone with a cell phone in the area into a suspect and working their way backwards from this list of data to find the most likely suspects.

Google's report showed an exponential escalation in geofence warrant deployments.

According to the data, Google received 982 geofence warrants in 2018, 8,396 in 2019 and 11,554 in 2020.

While regular search warrants generally show probable cause to search a suspect's property for evidence of criminal activity, the only probability needed for geofence warrants is the likelihood the data investigators are seeking is held by Google. This reversal of the probable cause equation has resulted in an explosion of requests sent to Google, but since the process involves the very early steps in a criminal investigation, there have been very few direct challenges of reverse warrant-derived evidence during criminal trials.

With Google unable to make a call as to whether requests are overbroad and court oversight being mostly an exception, it may be up to lawmakers to curtail the use of warrants that ask private companies to perform proxy searches for criminal suspects. Fortunately, some lawmakers are doing exactly that, as Zack Whittaker reports for TechCrunch. (h/t Michael Vario)

A New York bill that would ban state law enforcement from obtaining residents’ private user data from tech giants through the use of controversial search warrants will get another chance, two years after it was first introduced.

The Reverse Location Search Prohibition Act was reintroduced to the New York Assembly and Senate last year by a group of Democratic lawmakers after the bill previously failed to pass. Last week, the bill was referred to committee, the first major hurdle before it can be considered for a floor vote.

The bill, if passed, would be the first state law in the U.S. to end the use of geofence warrants and keyword search warrants, which rely on asking technology companies to turn over data about users who were near the scene of a crime or searched for particular keywords at a specific point in time.

The bill [PDF] anticipates the loopholes law enforcement might try to use and closes them. It also makes it clear the courts have no say in this matter at all.

§ 695.10 Issuance of reverse location court orders and reverse keyword court orders.
No court shall issue a reverse location court order or a reverse keyword court order.

As for state and local law enforcement agencies, their options are similarly nonexistent.

1. No government entity shall seek, from any court, a reverse location court order or a reverse keyword court order.

2. No government entity shall make a voluntary reverse location request or a voluntary and reverse keyword request.

3. No government entity shall seek, secure, obtain, borrow, purchase, use, or review any information or data obtained through a reverse location request or a reverse keyword request.

4. No government entity shall seek the assistance of any non-governmental entity, any agency of the federal government, or any agency of the government of another state or subdivision thereof in obtaining information or data from a reverse location court order, reverse keyword court order, reverse location request, or reverse keyword request if the government entity would be barred from directly seeking such information under this article.

So, that makes it pretty much impossible for law enforcement to route around the law. The courts are banned from issuing warrants. Investigators can't ask other agencies to execute reverse warrants on their behalf. And, if law enforcement somehow manages to obtain this data by utilizing an unforeseen loophole in the law, it still won't work. The ban provides for automatic suppression or exclusion of evidence derived from a geofence warrant.

In addition, the law provides a legal avenue to sue government entities if they do break the law. Citizens who've had their location info illegally obtained by law enforcement can sue the agency that performed the illegal search and recover $1,000 per violation and punitive damages.

It's a pretty solid law. And that means someone in the state legislature is going to try to kill it or, at least, neuter it into uselessness. Hopefully the bill's sponsors and supporters can guide it safely through the gauntlet of "tough on crime" legislators, overly powerful police unions, and overly powerful law enforcement agencies. Law enforcement has embraced this new way to obtain data generated by thousands of innocent people but has yet to prove it can be trusted with it. The best thing is to take the option away before it does any damage.

Filed Under: 4th amendment, general warrants, geofence, geofence warrants, new york, privacy, reverse warrants

Court Documents Show The FBI Used A Whole Lot Of Geofence Warrants To Track Down January 6th Insurrectionists

from the easier-to-do-when-most-people-are-in-an-area-illegally dept

The new hotness for law enforcement isn't all that new. But it is still very hot, a better way to amass a list of suspects when you don't have any particular suspect in mind. Aiding and abetting in the new bulk collection is Google, which has a collection of location info plenty of law enforcement agencies find useful.

There's very little governing this collection or its access by government agencies. Most seem to be relying on the Third Party Doctrine to save their searches, which may use warrants but do not use probable cause beyond the probability that Google houses the location data they're seeking.

Law enforcement agencies at both the local and federal levels have availed themselves of this data, using "geofences" to contain the location data sought by so-called "reverse warrants." Once they have the data points, investigators try to determine who the most likely suspect(s) is. That becomes a bigger problem when the area contained in the geofence contains hundreds or thousands of people who did not commit the crime being investigated.

These warrants have been used to seek suspects in incidents ranging from arson to... um... protesting police violence. They've also been used to track down suspects alleged to have raided the US Capitol building on January 6, 2021 -- the day some Trump supporters decided (with the support of several prominent Republicans, including the recently de-elected president) that they could change the outcome of a national election if they committed a bunch of federal crimes.

Plenty of those suspects outed themselves on social media. For everyone else, there's reverse warrants, as reported by Wired. (h/t Michael Vario)

Court documents suggest the FBI has been using controversial geofence search warrants at a scale not publicly seen before, collecting account information and location data on hundreds of devices inside the US Capitol during a deadly invasion by a right-wing mob on January 6.

While Google receives over 10,000 geofence warrants for location data in the US a year, those covering the Capitol breach appear to have been particularly productive, apparently enabling the FBI to build a large, searchable database in its hunt for the rioters.

Well, the documents do more than "suggest." The underlying warrants are likely still sealed, so some conjecture is involved. But other stuff has leaked out around the redactions and the sealing, showing the FBI was issuing warrants even while the attempted insurrection was still underway. The feds can move fast when needed, apparently. This is from a criminal complaint related to Mitchell Vukich -- one Capitol raider who not only tweeted he was inside the Capitol while still apparently in the Capitol ("I was one of the first 15 people in the #Capitol. Wild stuff. Be safe out there."), but was caught on several security cameras as he made his way through the building and seemingly ran off with some government documents.

According to records obtained through a search warrant which was served on Google, on January 6, 2021, in and around the time of the incident, a mobile device associated with mitchellvukich66@gmail.com was present at and in the interior of the U.S. Capitol on January 6, 2021.

However you may feel about the Asshat Revolution of January 6th, this isn't an ideal -- or even an acceptable -- way to conduct an investigation. Reverse warrants make everyone in the area a criminal suspect. Probable cause doesn't exist. It does in terms of Google: there's a highly probable chance the company has location data captured in areas under investigation. But law enforcement asks for all of it and works backwards to find suspects. Once it does that, it has probable cause to seek identifying information. But this method inverts the accepted (under the Fourth Amendment) formula for performing searches.

And, since the search warrant (as well as the results of the search) are still secret, we can only assume the FBI acted in good faith. It may not have.

“What might have happened is that the FBI got the anonymized data and just got straight back in touch with Google and said we suspect 90 percent of these people, so give us their IDs,” says Matthew Tokson, a law professor and Fourth Amendment expert at the University of Utah. “Or it may have been an atypical warrant where they said to Google: Give us not only the numbers but the account names, because we think we have probable cause on the bulk of them.”

And that's the concern law enforcement can keep from being addressed by asking for (and receiving) permission to seal warrant affidavits and discussions of this investigative technique, even though the technique is known and understood and already widely discussed in the public arena.

Suspects who think they can beat these warrants actually can't. A lot of that can be traced back to Google, which has never been completely honest about its location data harvesting. Some of that can be pinned on the suspects, who fail to understand that a factory reset only affects data stored on that device.

[C]ourt documents say that Jeffrey Register deleted photographs of his time in the Capitol and even claimed to have factory-reset his phone in the days after the breach to obscure his tracks. It was already too late; the FBI appears to have identified him from the Google geofence data in January…

That's the kind of thing that happens when you're cosplaying insurrection, OPSEC is an afterthought. For the people hunting you down, however, finding and acquiring reams of culpatory data is the thing they get paid to do. Getting high on your own supply of confirmation bias can have consequences, especially when it involves the impromptu violation of federal laws.

But at the end of all this is the skyrocketing use of reverse warrants to identify criminal suspects. That it has only resulted in a few false arrests is a miracle, not an endorsement of the investigative technique. While there has been occasional pushback against inverting the constitutional status quo, the large number of geofence warrants served to Google every year suggest law enforcement isn't too worried about losing access to a powerful tool that takes full advantage of private companies' apparently unslakable thirst for personal data.

Filed Under: 4th amendment, doj, fbi, geofence warrants, january 6th

Reverse Warrants Show Feds Sought Data On Thousands Of Police Brutality Protesters In Kenosha, Wisconsin

from the it's-ok!-the-NSA-said-this-was-cool-and-legal! dept

Is there anything law enforcement won't use geofence warrants for? The answer appears to be "no."

A recent Google transparency report shows exponential growth in the geofence (a.k.a. "reverse") warrant market, one that Google has inadvertently cornered by collecting more GPS info than any of its competitors. These aren't traditional warrants. Traditional warrants use probable cause to justify searches of places, people, and objects (like vehicles).

"Reverse" warrants are just that: a dragnet cast by cops to find a suspect in a pool of possibilities, most of whom are not criminals. Working backwards from a long list of GPS data points and cellphone information, investigators try to find the most likely suspect and then move forward again, this time using some actual probable cause. They're not always correct. And they seem largely unconcerned that demanding location data on hundreds, if not thousands, of innocent people perverts the process.

A recent report by Russell Brandom for The Verge shows the trend towards bulk collection continues. And, as reported previously, it involves federal agents who want to convert state charges to federal charges (using imaginative readings of the phrase "interstate commerce" to do so) to generate as much pain as possible for people who participated in protests against police violence, whether lawfully or not.

Protests in Kenosha, Wisconsin following the shooting of a black man by police quickly turned violent. Not only were businesses burned and destroyed, a 17-year-old interloper named Kyle Rittenhouse convinced his mom to drive him to Kenosha from his home in Antioch, Illinois. Once there, the armed Rittenhouse engaged in his vigilante fantasies, shooting three protesters, killing two of them.

The ATF was more interested in the arson, though. And it thought the best way to generate investigative leads was to gather information on thousands of protesters, almost every one of which did not start any fires.

A series of six newly unsealed warrants (1 2 3 4 5 6), some previously reported by Forbes, show a persistent effort to use Google’s location services to identify Android users in the vicinity of arson incidents.

Issued in quick succession on September 3rd, the warrants came from a team of 50 arson investigators from the bureau of Alcohol, Tobacco and Firearms, deployed to Kenosha to prosecute property damage cases connected to the protests. Using the warrants, The agents targeted seven different geographical zones, asking to identify anyone located within that area during a span that could stretch as long as two hours. The result was a kind of location dragnet, spread over some of the busiest times and locations in the first days of the protest.

The government wants haystacks. It firmly believes it can find needles. And it thinks it can do that often enough and with enough certainty no innocent hay will be treated like a criminal needle. That's insanely arrogant. The more data points you have, the more chances you have of picking the wrong one.

But maybe it really doesn't matter in these cases. After all, the DOJ and its components have proven more than happy to inflict collateral damage on protesters unhappy with the current state of law enforcement. If this ends in a few bogus arrests, does it really matter?

It might matter to the courts. A few judges have blocked these warrants, calling them vague and unconstitutional. And courts might be receptive to the arguments of those wrongfully arrested as a result of the use of these "reverse" warrants. The only probable cause the government has when it issues a geofence warrant is that it's likely Google houses the information it wants to collect. But it needs more than that. If all the government needed was the solid assumption a non-party/non-suspect possessed information it wanted, warrants could be completely unmoored from criminal investigations and used to grab any information the government has an interest in.

Those are legitimate concerns. Unfortunately, law enforcement doesn't share these concerns.

[One] warrant looks at a suspected arson of the Kenosha Public Library, based on lighter fluid and rags that were discovered in a northeast window well alongside minimal fire damage. Without direct witnesses to the fire, police set a two-hour window and a geofence covering the middle third of the downtown’s largest public park space. It was a significant span of time on the busiest night of the protest in an area that provided a natural meeting place for anyone who had taken to the streets that night.

I guess the ATF sees no harm in potentially rounding up several innocent protesters and subjecting them to facetime with federal agents -- federal agents who, by the way, can ring people up on charges simply for lying to them. The only thing standing between these warrants and some pretty ugly -- but inevitable -- outcomes is the courts. Google can anonymize information as much as possible, but follow-up demands are predicated solely on investigators' beliefs that they've found criminal suspects. How accurate those hunches are won't be discovered until they're in possession of identifying info -- info that can be traced back to the original dragnet supported by nothing more than the assumption grabbing all this data will allow investigators to continue their investigations.

Filed Under: 1st amendment, 4th amendment, atf, geofence warrants, kenosha, police, protests, reverse warrants, surveillance, wisconsin