State Appeals Court Says Exigency Beats A Warrant Requirement If A Phone Has A Passcode

from the there-is-no-'going-dark,'-I-guess? dept

The Supreme Court's Riley decision made one thing clear: cellphones are not to be searched without a warrant. Somehow, the Georgia Court of Appeals has reached a different conclusion than the Supreme Court of the United States, even as it cites the ruling. [h/t Andrew Fleischman]

It's a decision [PDF] that's decidedly law enforcement-friendly. And it's one that will pair nicely with the FBI's overblown "going dark" assertions. An arrested individual requested his phone so he could retrieve a phone number to give to the officers questioning him. Here's what happened once he had retrieved that info.

Once [Stephens] unlocked his phone, got the information that he needed, the phone was recovered from [Stephens] at that point. It had not locked out, and having the open pass code at that point, . . . I took the phone down the hall to one of our investigators that’s tech savvy and asked him to plug the phone in and do a phone dump, dump the information without reviewing the information and without advising me of anything if he even got anything off of the dump, that the purpose would be for me to be able to obtain a search warrant for the content of the phone. The experience we have is if the phone goes back to password protection, we’re not able to get into it.

A warrant was sought after the data had already been downloaded. Included in the data dump were photos of a gun prosecutors introduced as evidence. The suppression motion challenged the warrantless search. The lower court found a warrant should have been obtained before the data dump began.

The trial court recognized that Stephens had “a right to privacy in the contents of his cell phone,” and also further acknowledged that per Riley v. California, __ U. S. __ (134 SCt 2473, 189 LE2d 430) (2014), “the police may no longer, without a warrant, search such a phone when seized from an arrestee.”

But it also found the officers had a justifiable excuse for the warrantless data grab.

The trial court, however, found that post Riley, “[e]xigent circumstances – such as the risk of imminent loss of data through a remote wipe of the phone – can justify a warrantless search of a seized cell phone.” And, similarly, according to the trial court, police may “take steps to preserve the digital evidence stored in a cell phone while awaiting judicial authorization to search that evidence.” The trial court held that the measure taken here by police of downloading or “dumping” the contents from Stephens’s cell phone without looking at the contents, was permissible under Riley as a “protective step, taken solely to preserve evidence the detective reasonably believed could be destroyed.”

The appeals court sees the trial court's interpretation of Riley and raises.

Here, pretermitting whether the trial court correctly found that the warrantless downloading of the contents of Stephens’s cell phone was permissible under the exigencies exception to the Fourth Amendment, we hold that even if an unlawful search occurred, the evidence acquired from the downloading was admissible under the independent source doctrine.

[...]

Thus, even assuming that the initial downloading was an unconstitutional search, the information subject to the motion to suppress was obtained through the execution of a valid search warrant.

There you have it: two exceptions to the bright line drawn by the Supreme Court. Riley said warrants are needed to search cellphones. The Georgia Appeals Court agrees, but holds that as long as a warrant is obtained at some point in time, the search can happen prior to the acquisition of a warrant.

In this particular case, there's appears to be minimal intrusion. The information used during the trial wasn't acquired until after a search warrant was obtained, at least according to officers' testimony. But allowing searches to take place prior to the acquisition of a warrant encourages bad behavior -- like checking out data dumps for evidence first and building a warrant request around that, rather than the facts known to officers prior to the (warrantless) search.

It also encourages fishing expeditions because a warrantless search has no boundaries. Warrant requests and the judges that approve them set the limitations on the scope of searches, restricting them to only evidence relevant to the criminal allegations laid out in the affidavit. Working backwards from a search to a warrant means the government can redraft its warrant request prior to delivering it to a judge if it sees something else that might make for a better prosecution.

In this case, no search of the data dump occurred before the warrant arrived. That's good but it's not exactly Riley. Exigent circumstances could theoretically apply to any case involving a phone with a passcode, eliminating the warrant requirement and turning it into an afterthought. "Independent source" does the same thing, granting forgiveness for the constitutional violation as long as a warrant is sought post-search. This hole in Riley is somewhat narrowed by the court noting the warrant request wasn't based on any info derived from the data dump. But that only applies to the specifics of this case and that assumes officers won't lie about the chain of events or engage in parallel construction.

It also invites officers to use the "going dark" theory of unbreakable encryption to claim exigent circumstances guide phone searches, rather than the warrant requirement SCOTUS handed down. With cellphone encryption, any momentarily-unlocked phone creates a convenient "exigent circumstance" that's unlikely to be seriously challenged by courts. Even if other tools and workarounds can be used to crack a locked phone, the presence of one temporarily free of roadblocks will be searched to ensure maximum operational efficiency, rather than adherence to the Fourth Amendment as defined by the Riley decision.

This is a bad call by the Appeals Court. It could have found a way to deter future abuse without actually suppressing the evidence. Instead, it gave Georgia law enforcement a road map for warrantless phone searches.

Filed Under: 4th amendment, exigency, georgia, passcode, phone search, privacy, riley, warrant

Court Says Abandoned Phone Locked With A Passcode Still Has Expectation Of Privacy

from the warrants-still-apparently-the-most-difficult-document-to-obtain dept

A Florida Court of Appeals has handed down a somewhat surprising ruling [PDF] in a case centering on evidence obtained from a teen's cellphone. (via FourthAmendment.com)

Two juveniles fled their vehicle during a traffic stop, with one of them (referred to as "K.C." in the ruling) leaving behind his cellphone on the car's seat. This phone -- whose lockscreen featured a photo of someone who "looked similar" to "K.C." -- was taken by the officer.

Several months later, the PD's forensic lab was asked to determine ownership of the phone. The phone was locked with a passcode, but the lab was able to unlock and retrieve this information. No warrant was obtained and the search apparently wasn't limited to determining ownership. The use of evidence obtained from the phone was challenged, but the state felt it had plenty of warrant exceptions to save its search.

K.C. was charged with burglary of a conveyance. He moved to suppress the contents of the cell phone, from which the police had obtained his name, on the ground that the phone was searched without a warrant. After the presentation of the foregoing facts, the prosecutor argued that the phone was abandoned, and the owner had no expectation of privacy in the phone once abandoned.

Generally speaking, abandonment of property results in privacy expectations being stripped. In this case, however, the court found that K.C.'s use of passcode meant that he retained an expectation of privacy even after leaving the phone behind.

The court points to the Supreme Court's Riley decision, noting that today's smartphones are not simply "locked containers." They are more equivalent to a locked house, considering the wealth of information contained in them. If law enforcement can't search a house without a warrant simply because the resident fled when seeing them ("abandoning" the house), it can't search a locked cellphone simply because it was left behind by a fleeing suspect.

It quotes this section of the Riley decision on the way to its conclusion:

In 1926, Learned Hand observed (in an opinion later quoted in Chimel) that it is “a totally different thing to search a man’s pockets and use against him what they contain, from ransacking his house for everything which may incriminate him.” United States v. Kirschenblatt, 16 F.2d 202, 203 (C.A.2). If his pockets contain a cell phone, however, that is no longer true. Indeed, a cell phone search would typically expose to the government far more than the most exhaustive search of a house: A phone not only contains in digital form many sensitive records previously found in the home; it also contains a broad array of private information never found in a home in any form—unless the phone is.

It then addresses the state's claim that abandoned property of all types no longer carries an expectation of privacy.

Our supreme court has recognized that “[t]he test for abandonment is whether a defendant voluntarily discarded, left behind, or otherwise relinquished his interest in the property in question so that he could no longer retain a reasonable expectation of privacy…"

[...]

While we acknowledge that the physical cell phone in this case was left in the stolen vehicle by the individual, and it was not claimed by anyone at the police station, its contents were still protected by a password, clearly indicating an intention to protect the privacy of all of the digital material on the cell phone or able to be accessed by it. Indeed, the password protection that most cell phone users place on their devices is designed specifically to prevent unauthorized access to the vast store of personal information which a cell phone can hold when the phone is out of the owner’s possession.

It's the steps taken to protect the phone's contents that determines the expectation of privacy in abandoned phone. The court doesn't appear to be extending this protection to all abandoned cellphones.

The court also points out that, given the circumstances of the case, seeking a warrant would have been a very minor inconvenience.

Where a cell phone is “abandoned,” yet its contents are protected by a password, obtaining a warrant is even less problematic. In this case, how difficult and inefficient would it have been for the officer to obtain a search warrant, when the cell phone in question was in police possession for months?

Also of note: the good faith exception was never raised, otherwise this decision may have gone the other way. That's rather surprising, considering it's almost always raised when evidence might be suppressed, no matter how far away removed from any common definition of "good faith" the government's actions were.

It would also be interesting to see this line of thinking applied to the Third Party Doctrine. If attempts are made to limit the generation of third-party records (the use of VPNs/Tor for web browsing, shutting off GPS location for phones, etc.), does that give the records that are still generated a greater expectation of privacy? Or would it simply be assumed that, no matter what efforts are made by cellphone/computer users, anything held by a third party can still be obtained without a warrant?

Filed Under: 4th amendment, florida, passcode, privacy, traffic stop

DOJ Drops Other Big Case Over iPhone Encryption After Defendant Suddenly Remembers His Passcode

from the wait,-what? dept

While so much of the attention had been focused on the case in San Bernardino, where the DOJ was looking to get into Syed Farook's iPhone, we've pointed out that perhaps the more interesting case was the parallel one in NY (which actually started last October), where the magistrate judge James Orenstein rejected the DOJ's use of the All Writs Act to try to force Apple to help unlock the iPhone of Jun Feng, a guy who had already pled guilty on drug charges, but who insisted he did not recall his passcode.

There were some oddities in the case. Feng had pled guilty and there was some issue over whether or not there was still a need to get into the iPhone. The DOJ insisted yes, because Feng's iPhone might provide necessary evidence to find others involved in the drug ring. The other oddity: Feng's iPhone was running iOS7. While the device itself was a newer model iPhone than the one in the Farook case, it still has an older operating system, where it was known that Apple (and others) could easily get in. So it made no sense that the FBI couldn't get into this phone. In fact, Apple's latest filing in the case, just over a week ago was basically along those lines, noting that the DOJ claimed Apple's assistance was "necessary," but that seemed unlikely.

And... late on Friday, the DOJ did the exact same "run away!" move it did in the Farook case, telling the judge that it had suddenly been given the passcode, so there was no need to move forward with the case at all.

The government respectfully submits this letter to update the Court and the parties. Yesterday evening, an individual provided the passcode to the iPhone at issue in this case. Late last night, the government used that passcode by hand and gained access to the iPhone. Accordingly, the government no longer needs Apple’s assistance to unlock the iPhone, and withdraws its application.

According to a (paywalled) WSJ article, Feng, who has been waiting for his sentencing, and thinking that his case was otherwise over, only just found out that there was this big fuss around his own case... and told the DOJ he miraculously remembered the passcode. Hallelujah. A miracle... and the DOJ was magically saved from a precedent it didn't want.

The Wall Street Journal reported last week that Mr. Feng only recently learned his phone had become an issue in a high-stakes legal fight between prosecutors and Apple. Mr. Feng, who has pleaded guilty and is due to be sentenced in the coming weeks, is the one who provided the passcode to investigators, according to people familiar with the matter.

Of course, it's worth noting, however that while this particular case may be effectively over, it's not that great for the DOJ, in that no one got to officially review magistrate judge James Orenstein's fairly epic smackdown of the DOJ earlier in the case. That, of course, has no value as a precedent, but that doesn't mean it won't be quoted or pointed to in other, similar cases.

On the flip side, of course, there's the argument that every time the case starts looking bad for the DOJ, they miraculously get into the phone in question. At the very least, this ought to raise questions about why the DOJ keeps insisting that it needs Apple's help... But the fact is these cases are going to keep coming.

Filed Under: all writs act, doj, encryption, going dark, iphone, jun feng, passcode
Companies: apple

UK Law Enforcement Trying To Force Man They've Never Charged With A Crime To Decrypt His Computers

from the see-smoke,-presume-arson dept

British hacker Lauri Love stands accused of causing "millions of dollars" in damages to US government computers -- charges he's been facing for more than two years. These charges originate in the US, but it's the UK that's been trying to get Love to give up his encryption keys for the past couple of years.

Under RIPA (Regulation of Investigatory Powers Act of 2000), the UK government can charge Love with "failure to cooperate" by refusing to comply with the order to decrypt files. To date it has not done so, despite Love blowing off its demands since the middle of February 2014.

The only charges Love is facing have been levied by the US Department of Justice. He has fought extradition for the past couple of years and the UK government has yet to make any progress on that front. However, UK law enforcement has stepped up its efforts to force Love to turn over passwords and keys. J.M. Porup at Ars Technica has seen a copy of the request and has more details.

In the NCA's submission to the court, which Ars has seen a copy of, the government demanded that Love turn over the passwords and encryption keys to his confiscated devices. The devices in question include a Samsung laptop, a Fujitsu Siemens laptop, a Compaq computer tower, an SD card, and a Western Digital hard drive. The NCA in particular wants Love to decrypt TrueCrypt files on the SD card and external drive.

This seems like a very severe demand from the National Crime Authority, considering it still hasn't -- despite two years and two arrests -- seen fit to bring criminal charges against Love. This is also its second attempt -- one using a separate legal authority (not RIPA Section 49, as was used earlier) -- to compel Love to comply with its demands.

Meanwhile, Love is (logically) suing the UK government for the return of his devices.

Love's argument in his civil case is that if the police aren't going to charge him with a crime, they should return his property. "The problem is that the NCA are effectively arguing that any information that cannot be read and comprehended by the police has a presumption of guilt," Love told Ars in an e-mailed statement.

As Love points out, equating encryption with guilt has severe ramifications for anyone who uses it.

"This has clear and troubling implications for groups that handle sensitive communications or other data—journalists, advocates, activists and whistleblowers, and members of the legal profession.

"An executive body of the state is saying that any information to which they are not privy... cannot be owned and kept securely but instead confiscated and access denied," Love added. "This is a fundamental reversal of rights and the potential for abuse is alarming."

The NCA claims it wants Love to decrypt his devices so he can prove his ownership of any information or data found on them -- which allegedly includes pirated film and documents obtained (without permission) for US government websites. Love sees this as nothing more than the NCA trying to help out its American counterparts by using the UK's more permissive laws to obtain information about Love's hacking activities. And, it must be pointed out again -- the NCA wants to force the uncharged Love to crack open his devices so it can find something to charge him with.

Maybe there's something incriminating stored on Love's computers. Maybe not. But either way, UK law enforcement is working backwards from a presumption of guilt. And it's basing this all on things it can't see. This belief system is similar to that held by many law enforcement agencies, which have spent much of the last few months claiming an encrypted phone is a "guilty" phone in front of judges, Congress and to members of the media.

Filed Under: decrypt, doj, encryption, lauri love, nca, passcode, ripa, uk, us

DailyDirt: Breaking Bad... Passwords

from the urls-we-dig-up dept

Passwords are everywhere. They get us access to our phones, computers, email, social media accounts, cloud storage accounts, banks accounts... just about everything important (and unimportant -- which is part of the problem with passwords). You might think you're clever by choosing a 4-digit PIN that doesn't look like a birthday date or year, but if you're using 2580 and think you're smart, think again.

• The iPhone's 4-digit passcode can be broken by brute force in roughly 111 hours or less. Sure, you could use your fingerprint, but it might be better to just turn off the "simple passcode" default and use more digits. [url]
• Plenty of password alternative schemes are springing up to move people away from passwords and towards other kinds of authentication. All the big tech companies are trying out various password alternatives. Google is experimenting with a dongle/token/USB key approach. Yahoo is trying out a password-free login. Passwords still seem to be the dominant method for logins, but that could change... someday. [url]
• If you have an old wireless router and it only uses WEP passwords, should you use it? Well, even if you use a WPA password, it only takes a few hours to crack... so just stay paranoid. [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: dongle, fingerprint, logins, passcode, password-free, passwords, pin, security, tokens
Companies: google, yahoo