CBP, ICE Hoovering Up Cell Location Data From Third Party Vendors To Track Down Immigrants

from the 'legal-gray-areas'-is-where-we-do-our-best-work dept

Supreme Court precedent says the government needs a warrant if it wants to get cell-site location info. This ruling altered the contours of the Third Party Doctrine, making it clear not every third-party record exists outside the Fourth Amendment's protections.

But that only applies to location info gathered from cell service providers utilizing the data they collect from cell tower connections. When the government wants to track the movement of individuals, it can do it, but it needs a warrant. When it just wants a bunch of location data on everyone in an area, somehow the warrant requirement disappears.

That's what CBP and ICE are doing. According to a report by the Wall Street Journal [paywall], the agencies are buying location info in bulk from third-party vendors. No warrant required.

The Trump administration has been using commercial data that tracks millions of smartphone users' locations to help enforce its policies on immigration and deportation, according to a report Friday from the Wall Street Journal.

The database, owned by a company called Venntel Inc., collects information from run-of-the-mill games, weather and shopping smartphone apps where users have agreed to share their location, according to the report.

This isn't cell-site location info, technically. But a lot of this location data wouldn't exist without cell towers. The CBP believes this is all very legal, as it does not target any one person and, in a rather stupid assertion, claims the data is "pseudonymized." This means the location data isn't linked to identifying info about the cell phone's owner. But that word means even less than the usual "anonymized." The application of analytic tools can strip this anonymization away, even without additional data pulled from other sources.

If the data were truly anonymized, it would be worthless: just a bunch of data points unrelated to anything. But it obviously isn't anonymized -- or at least isn't that way for long after the agencies obtain it -- or the government wouldn't be saying things like this:

Sources told the Journal that Immigrations and Customs Enforcement (ICE) and Customs and Border Protection (CBP), two divisions under the Department of Homeland Security (DHS), have used the location data to help them identify and locate those who may have entered the country unlawfully, whom they later arrested.

Both agencies have been using this data since 2017, according to contract info obtained by the Wall Street Journal. For now, it's still legal to obtain this data from third parties without a warrant. It's unlikely this data will see a successful challenge any time soon, not if it's coming from third parties that have been given explicit permission to collect location data.

But that doesn't mean current protections for cell-site location info won't eventually expand to cover third parties like Venntel. Voluntarily sharing location info with a company isn't the same thing as voluntarily sharing data with the government, no matter how much the government argues there's no expectation of privacy in records freely given to third parties. Many people feel more comfortable sharing data with companies, since the end result tends to be things like targeted ads, rather than targeted investigations.

Oddly, CBP claims the data is not "ingested in bulk," which seems to run counter to how this data is purchased. If it's truly anonymized, the CBP has no choice but to obtain it in bulk and work from there to determine who it's targeting for removal. Perhaps the CBP's definition of "bulk" is different than the common definition of "bulk." Maybe the agency believes that throwing up a couple of geofences prevents this from being a "bulk" collection. If so, the government is wrong. Anything that provides massive amounts of data from multiple sources is a, by definition, a "bulk collection."

This is working for the government right now. But sooner or later, this haystack-building method will likely find itself on the wrong side of the Constitution, especially when courts are informed of just how meaningless the word "anonymized" is in the context of bulk location data.

Filed Under: 3rd party doctrine, cbp, cell site location info, commercial purchases, csli, dhs, ice, location tracking, privacy, warrants

Court (Barely) Allows Class Action Lawsuit Over Google's Location Tracking To Move Forward

from the tough-to-cry-'foul'-when-you're-opting-in dept

A 2018 lawsuit [PDF] against Google over location tracking survives, but only just. The lawsuit -- filed after a report showed Google was still collecting location data even after users shut off location services on Android phones -- alleges Google violated California laws and privacy protections by tracking users (including children) after it had been told not to.

The lawsuit has been dismissed [PDF], but the court is giving the plaintiffs a chance to amend the lawsuit and suggesting there are issues the court alone can't decide. (via FourthAmendment.com)

The plaintiffs allege they were led to believe Google would no longer collect and store location data when "Location History" was shut off. They cite Google's own support page, which (formerly) stated "With Location History off, the places you go are no longer stored." The court says this language could have misled users, no matter what Google's Privacy Policies and Terms of Services actually said about location data.

Drawing all inferences in favor of Plaintiffs, a reasonable user could believe that disabling Location History prevented Defendant from collecting and storing geolocation data. This conclusion is bolstered by the fact that many people were mislead by the effect of disabling Location History. See, e.g., Compl. ¶ 4. Moreover, the support page Defendant points the Court to was created after this litigation had already commenced. At the time Plaintiffs’ original complaints were filed, the page described Web & App Activity as merely a means to “[s]ave your search activity on apps and in browsers to make searches faster.” Id., Ex. 28. The page did not expressly state that geolocation data may be collected.

Google argues that users consent to sending location info to Google when using some of its services. That may be, but the court points out people agreeing to send some data to Google when using products like Google Maps is not the same thing as granting Google permission to store that data indefinitely. No good, says the court.

The Court thus rejects Defendant’s contention that by consenting to transitory use, Plaintiffs consented to geolocation collection. To the contrary, it is plausible that Plaintiffs gave a narrow consent to geolocation tracking, exclusive of data storage.

Either way, it's probably not going to be settled at this stage of litigation, which is already in its sixteenth month.

It is plausible that Plaintiffs only consented to transitory use tracking and revoked any consent to the storage of their geolocation history. It is also plausible that they did not revoke such consent. The Court cannot conclude either way—factual disputes remain. “This is an issue for the jury.” Opperman, 205 F. Supp.3d at 1073 (holding that the plaintiffs produced sufficient evidence showing they did not consent to the defendants’ actions). For these reasons, the Court holds Plaintiffs have plead sufficient facts to show they did not consent to the storage of their geolocation information

The court does dismiss the plaintiffs' CIPA (California Invasion of Privacy Act) claims. By conceding they gave Google permission to collect location data when using Maps or checking "showtimes for movies playing nearby," the litigants have undercut this claim.

Hence, Plaintiffs issue is not with Defendant tracking them during application use, rather their issue is with the storage of that data. See Opp. at 3–4 (“[I]n accepting the transitory use of location information for an immediate, discrete purpose, Plaintiffs in no way consented to indefinite storage of their daily locations and movements . . . .”). For this reason, Plaintiffs’ CIPA claim fails as a matter of law because CIPA, by its plain terms, is not concerned with data storage but focuses on unconsented data tracking, which is not at issue.

That claim is dismissed with prejudice as the court sees no way the plaintiffs can amend this particular claim to make it actionable.

The California-based invasion of privacy claim fails as well, but not as badly. Invasion of privacy claims are Fourth Amendment-related, but the court sees nothing in Google's actions that could possibly be a Fourth Amendment issue, even with recent Supreme Court decisions expanding citizens' expectations of privacy.

Plaintiffs contend that Defendant’s surreptitious collection and storage of comprehensive and highly sensitive location data violates their information privacy rights. Opp. at 15. Even if the collection of granular and specific location data establishes an information privacy interest, Plaintiffs’ theory is undercut by the admission that Defendant only tracked and collected data during use of Google services. Accordingly, Defendant’s “profile” of a user is only as specific as their use of Google services. Carpenter v. United States and United States v. Jones do not undercut this conclusion.

What Google collected was far less than what the plaintiffs' cellphone providers collected, and yet, the lawsuit only alleges a violation by Google.

First, there was no claim that MetroPCS and Sprint, the phone companies holding the cell-site location information, violated the plaintiff’s right of privacy by having such robust geolocation records. Id. at 2212. The case thus does not stand for the proposition that geolocation collection violates the right of privacy.

Second, the cell-site location information discussed in Carpenter was comprehensive—the cell-site location information provided cellular companies with a rough “map” of a customer’s fluid movements. Id. at 2211. Such comprehensive data collection is not at issue here; Plaintiffs’ geolocation information depends on how often they use Google’s services. Defendant’s collection of geolocation data is not automatic; it does not happen by the routine “pinging” of a cell-phone tower.

[...]

Here, unlike the continual GPS tracking in Jones, not all of Plaintiffs movements were being collected, only specific movements or locations. Such “bits and pieces” do not meet the standard of privacy established in Carpenter or Jones.

This allegation is being allowed to move forward, though. But it probably won't live on for long if the plaintiffs can't find something more specific to allege than a theoretical "mosaic" of the plaintiffs' movements, which possibly included visits to "sensitive or confidential locations."

It's not that Google is in the right if it misled phone users into thinking they weren't being tracked when they were being tracked. It's also not right just because cellphone service providers track location almost continuously. But if the claim is that Google collected users' location data when users utilized services they knew would send that data to Google, then the lawsuit should fail.

Filed Under: class action, location history, location tracking
Companies: google

University Of Alabama Is Using A Location-Tracking App To Punish Students For Leaving Football Games Early

from the surveillance-state-perks dept

One of the most successful college football programs in history is coached by one of the most insecure men in America, apparently. This combination of success and neediness has resulted in one of the weirdest forms of location tracking in government history. (via Slashdot)

[Nick] Saban, the Alabama football coach, has long been peeved that the student section at Bryant-Denny Stadium empties early. So this season, the university is rewarding students who attend games — and stay until the fourth quarter — with an alluring prize: improved access to tickets to the SEC championship game and to the College Football Playoff semifinals and championship game, which Alabama is trying to reach for the fifth consecutive season.

But to do this, Alabama is taking an extraordinary, Orwellian step: using location-tracking technology from students’ phones to see who skips out and who stays.

Yes, this is all voluntary, but it's entirely unique to the University of Alabama. As the team blows out early season creampuffs, Coach Saban wants to see the stands full of bored students dressed in crimson and tied to their seats by an app that will take students out of prime ticket consideration if they choose to do something more worthwhile with their time.

The app comes from a software developer that has created apps for several universities. But Alabama's app is one of a kind.

The creator of the app, FanMaker, runs apps for 40 colleges, including Clemson, Louisiana State and Southern California, which typically reward fans with gifts like T-shirts. The app it created for Alabama is the only one that tracks the locations of its students.

To boil things down to a concerning reduction, a publicly-funded university used public funds to purchase an app that tracks students' location. The app can be deleted at any time and only tracks students while they're in the stadium, but leaving the stadium and/or ditching the app sends students to the back of the line for tickets to games that actually matter, like conference championship games featuring the omnipresent Alabama.

What's also weird is that the reward for fourth quarter attendance -- 250 points -- is roughly equivalent to the points earned for 2.5 credit hours, showing how meaningful the university considers fourth quarter attendance in meaningless games.

The app is apparently popular with students, so much so that the school's home opener crashed the server, forcing students to become their own surveillers to prove they had stayed all the way to the end of the 62-10 "contest."

The stadium’s network servers were overwhelmed by the number of fans in the student section, which seats 17,000 — slightly more than half the student body. That meant that many students were unable to open their apps, leading to long lines at several help kiosks and students taking photos with the scoreboard in the background to prove they had stayed.

Loyalty matters. It apparently matters more than student safety (the temperature was near 100 degrees for most of the game). That's changing. The university has decided to alter the terms of its surveillance to allow for weather-related early exits. That's not sitting well with Coach Saban who would apparently rather have the student section filled with lifeless bodies than see students exiting a game that ceased to be competitive shortly after kickoff.

“Everybody wants to be the beast, but they don’t want to do what the beast do,” Saban said afterward. “So everybody’s got to make a sacrifice. I mean, you want to be the lion?”

He was just getting warmed up.

“Everybody’s got to do something,” he continued. “Everybody wants to be No. 1. If I asked that whole student section, ‘All right, you want to be No. 1?’ Nobody would put their hand up and say, ‘I want to be No. 4.’ They’d all say we want to be No. 1. But are they willing to do everything to be No. 1? That’s another question. Ask them that. I don’t know the answer.”

At this point, it's maybe time to discuss the separation of church and state. The publicly-funded college shouldn't be pressuring students to attend something Coach Saban clearly considers to be a religious event.

Filed Under: attendance, football games, location tracking
Companies: university of alabama

Denmark Releases 32 Prisoners Convicted Because Of Flawed Mobile Phone Tracking Data

from the but-how-many-more-to-come? dept

A few weeks ago, Techdirt wrote about Denmark reviewing 10,000 court verdicts because of errors in mobile phone tracking data that was offered as evidence in those cases. At that time, it wasn't clear how many of the group were affected by the unreliable data. However, the Guardian reports that 32 people have already been freed. Given the large number of cases involved, it seems unlikely that many have been reviewed in such a short space of time. If that's the case, it is possible that quite a few more verdicts will be overturned, and more people released. Companies providing mobile phone services in Denmark are naturally keen to distance themselves from this mess. Jakob Willer, speaking on behalf of the country's telecoms industry association, said it was not their job to provide evidence:

"We should remember: data is created to help deliver telecom services, not to control citizens or for surveillance," Willer said. He conceded it could be valuable to police, but insisted its primary purpose was to facilitate communication between users.

That's an important point. If the authorities wish to use this kind of data they need to take into account that it was never designed to track people, and therefore has limitations as evidence. Fortunately, Denmark's embarrassing discovery that an unknown number of over 10,000 verdicts may be based on unreliable evidence has been something of a wake-up call for the country's lawyers. Karoline Normann, the head of the Danish law society's criminal law committee, told Agence-France Presse:

"This situation has changed our mindset about cellphone data. We are probably going to question it as we normally question a witness or other types of evidence, where we consider circumstances like who produced the evidence, and why and how."

It's troubling that it didn't occur to the legal profession to do that before. Just because information comes from high-tech sources doesn't mean it is infallible or that it can't be challenged.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: csli, denmark, evidence, location info, location tracking, privacy

Fifth Circuit Court Of Appeals Upholds Decision That Warrantless Cell Phone Tracking Doesn't Violate Fourth Amendment

from the sadly,-another-one-for-the-'unsurprising'-column dept

The ongoing court battle over warrantless cell phone location tracking continues and the latest decision is another setback for the Fourth Amendment. The Fifth Circuit Court of Appeals held that individuals have no reasonable expectation of privacy over their location data. The decision states that location data is a "business record" created by private companies with the implicit consent of cell phone users and therefore are not subject to privacy protections.

[C]ell site information is clearly a business record. The cell service provider collects and stores historical cell site data for its own business purposes . . . the government merely comes in after the fact and asks a provider to turn over records the provider has already created.

The rationale is that cell phone companies are not required by the government to create or retain this data and that citizens are not required by the government to carry or use cell phones, thus making this data subject to the Third Party Doctrine and removing any expectation of privacy.

This rationalization goes counter to the recent NJ Supreme Court decision (unrelated other than in subject matter), which found that location data should be subject to privacy protections for nearly the same reason. Although cell phones aren't in any way "mandatory," the court stated that no one uses a cell phone with the intent of creating a location-specific metadata trail for law enforcement to scoop up without a warrant.

The decision to declare cell phone location data "business records" also plays into the hands of intelligence agencies like the NSA and FBI, allowing them to harvest vast amounts of data on Americans without running the risk of violating their constitutional rights (at least, not according to these interpretations). The court also added that there is some form of recourse for citizens worried about their rights being violated -- but both suggestions are a dead end.

"But the recourse for these desires is in the market or the political process: in demanding that service providers do away with such records (or anonymize them) or in lobbying elected representatives to enact statutory protections."

As the ACLU points out, neither of these "remedies" are likely to result in additional privacy protections.

Regarding the first point, perhaps the court is unaware how opposed the cell phone companies are to even disclosing how long they keep subscriber data. It took a nation-wide public records act request campaign before we received a Justice Department information sheet on how long carriers keep such records. (According to the 2010 document, Verizon keeps historical cell phone records for "1 rolling year" while Sprint keeps them for "18-24 months.") There is no cell phone company that doesn't retain historical cell site location data, or even one that keeps it only for a short time. And anyway, our Fourth Amendment rights should not depend on the largesse of for-profit corporations.

As for pressing for Congressional change, the ACLU has been doing just that for years. (The federal statute the government uses to obtain cell phone location records was written way back in 1986 and hasn't been meaningfully updated since.) But the mere fact that some other branch of government could provide a remedy is no reason for courts to take a pass on protecting Americans' privacy.

Expecting corporations to protect your privacy is, for the most part, a non-starter, especially if these corporations can monetize the data in any way. Furthermore, how many people actually believe the government would allow cell phone providers to simply scrap the data (or anonymize it) once it's served it purpose (monthly billing, for instance), rather than retain it for months on end? Intelligence agencies and law enforcement would simply push for legislation and court orders to ensure this flow of data continues uninterrupted.

In a 25-page dissent, Judge James Dennis pokes holes in the majority's "business records" rationalization, quoting Justice Sotomayor's reservations about the majority's opinion in US vs. Jones:

[In future cases] considering the existence of a reasonable societal expectation of privacy in the sum of one’s public movements[,] . . . it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers. . . . I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection.

By allowing law enforcement to access "business records" without a warrant, the Court opens up the possibility that these agencies will find a person's internet history, email and contact lists to be similarly devoid of Fourth Amendment protections. Saying one thing is a business record and one thing isn't only further obscures an aspect that needs clear delineation, one that would preferably draw the line before location data rather than attempt to determine which "parts" of a person's cell phone are subject to privacy protections.

We also have to ask why there's such an aversion to obtaining a warrant. In many cases, the information needed is historical. In other cases, when something more current or time-sensitive might be needed, there are emergency orders and other legal remedies (once in the courtroom) to allow some warrantless data collection to be admitted as evidence. The more these battles drag on, the more it appears that these agencies are benefiting from multiple interpretations of outdated laws, a benefit they'd clearly prefer to keep intact. This creates a path of least resistance, which becomes especially problematic when combined with the agencies' natural tendency to collect as much data as possible, "just in case."

Filed Under: 4th amendment, business records, expectation of privacy, fifth circuit, gps, location tracking, phone tracking, privacy, third party doctrine

DOJ Tells Senator Wyden That Incoming FBI Director James Comey Has No Intention Of Answering His Questions

from the probably-not-the-best-idea dept

On Monday, the Senate overwhelmingly confirmed James Comey to be the new FBI director, despite significant concerns raised about his views on civil liberties and surveillance. Senator Rand Paul had blocked the vote for a while, claiming he wanted answers concerning whether or not Comey believed the FBI could use drones without a warrant. The FBI finally responded to Paul saying that it believed that it had the authority to use drones without a warrant, prompting Paul to stop the block (which would have been overridden shortly anyway), and then he was the lone "no" vote against Comey, who was approved 93-1. However, at least the DOJ was willing to answer Senator Paul's questions.

Senator Ron Wyden also expressed concerns about Comey's views on surveillance, and had sent a letter asking a variety of questions about Comey's views on the subject, "including whether he believes warrantless wire tapping is legal, and whether he would commit to explain how much evidence the FBI needs to track Americans using their cell phone location data." In response, the DOJ basically told Wyden to get lost:

Mr. Comey could have answered most or all of these questions without disclosing any properly classified information, but the Justice Department informed me today that he will not be responding to any of them.

Remember, Wyden serves on the Intelligence Committee, which is in charge of oversight of the intelligence community. One would think that flat out refusing to answer his questions is not the best way to respond to a member of the committee in charge of your oversight. In the end, Wyden voted "present" rather than "no," but stated that he could not vote in favor of Comey.

Filed Under: doj, fbi, james comey, location tracking, ron wyden, surveillance, warrantless wiretapping