Kansas Court Rejects Government's 'Reverse Warrant,' Sets Ground Rules For Future Requests

from the getting-some-of-that-crucial-bulwarking-done dept

We haven't seen a lot of legal challenges to so-called "reverse warrants." This is likely due to their relative novelty. It's probably also due to the fact that no one "targeted" by these warrants knows about them until well after an investigation has been closed.

Reverse warrants don't target people or places. They target (and I'm using that term loosely) areas roughly defined/confined by GPS coordinates. Everything inside the geofence is a target. Working backward from the data obtained from companies like Google, investigators try to determine which of these data points is their suspect.

For the time being, it's mostly up to the judges reading the warrant affidavits to raise challenges to the methods used or the broadness of request. And, so far, we've only seen one rejection of a reverse warrant, albeit one rejected twice by consecutive judges (a magistrate and a district court judge).

Now we have one more rejection to examine, coming to us via FourthAmendment.com. A magistrate judge in Kansas has rejected [PDF] the government's attempt to obtain location data from Google. The magistrate notes that judges all over the nation should expect to see more of these as time goes on and should be aware of the constitutional issues at play when the government works backwards from bulk data to identify a criminal suspect. Because this investigative technique is only expected to become more common, this judge has decided to set some ground rules for the government's future attempts to work its way backwards to probable cause.

The court issues this written order not only to address the subject application, but also to provide guidance for future search warrant applications involving geofence technology given the relatively sparse authority on this issue.

And the court is doing this because this warrant just doesn't cut it, constitutionally speaking.

Here, the application and accompanying affidavit are not sufficiently specific or narrowly tailored to establish probable cause or particularity. The court therefore denies the application without prejudice.

The order doesn't detail the federal crime suspected of being committed but does note it involves a heavily trafficked business. The government is seeking location data on every device in the area during a one-hour period. That isn't narrow enough for the court.

The application here establishes probable cause that a crime was committed at the subject business establishment during the relevant one-hour time period. However, it does not establish probable cause that evidence of the crime will be located at the place searched—that is, Google’s records showing the location data of cell phone users within the geofence boundaries.

The court notes it's obviously true that Google's data would show what devices were in the business during this time period, but goes on to point out the flaws in the warrant affidavit. The warrant request, as written, fails to provide a link between the data sought and the suspected criminals.

The court has considered the agent’s statements in the current application based on his training and experience, and finds that they are too vague and generic to establish a fair probability—or any probability—that the identity of the perpetrator or witnesses would be encompassed within the search. For beginners, the affidavit does not suggest that any relevant perpetrator or witness even had a smartphone. In Arson, the court relied on an affidavit that explained that that co-conspirators probably would have been coordinating their efforts by phone. Here, the affidavit contains no analogous explanation, whether based on the agent’s training and experience or based on the facts of the investigation. To the contrary, the affidavit suggests only that the culprit was a lone pedestrian in the early morning hours who was caught on surveillance footage. The affidavit conspicuously omits any suggestion that the surveillance footage shows that the individual had a cell phone.

Almost everyone carries a phone wherever they go. Almost. And there's no reason to believe the phone being gradually targeted here would be transmitting location data to Google. Android devices may make up 85% of the market, but that's not enough market share for the court to ignore the assumptions made by the agent seeking the warrant. iOS users don't always send location data to Google. Android users have the option to deny Google access to location data. The judge says there's too much unknown to allow this warrant to be granted without modification.

The judge also says the warrant makes a mockery of probable cause by allowing the government to treat every person in the area as a suspect until proven otherwise.

The application also does not address the anticipated number of individuals likely to be encompassed within the targeted Google location data. This also goes to the particularity requirement, which is intertwined with probable cause. If a geofence warrant is likely to return a large amount of data from individuals having nothing to do with the alleged criminal activity—as in Pharma I & II—the sheer amount of information lessens the likelihood that the data would reveal a criminal suspect’s identity, thereby weakening the showing of probable cause.

And that may result in a whole lot of incidental targeting that could negatively affect the rights and freedoms of people who had nothing to do with the alleged crime.

[T]he geofence boundary appears to potentially include the data for cell phone users having nothing to do with the alleged criminal activity. The boundary encompasses two public streets, so anyone driving their automobile by the target location during the relevant time period could be identified in the data. Google Maps also indicates that the subject building contains another business, which the application does not address. The government is also seeking data within the geofence’s “margin of error,” meaning that it seeks location-point data outside of the geofence but which could conceivably fall within the geofence if the margin of error would permit the device to be located within the parameters. See Pharma II, 481 F. Supp. 3d at 745 n.11 (describing the margin of error). As a result, the warrant may return data from users who are outside of the radius of the geofence. Id. Google Maps shows that the area just outside of the perimeter of the geofence includes residences and other businesses that could be implicated by the margin of error.

The government supplied no data or specifics on the expected margin of error nor did it explain what steps it would take to ensure it only gathered as much info as needed to identify its suspect.

The court also says the time period of the data sought is far too long and too disconnected from the criminal activity.

The application also does not adequately justify the time period requested. It seeks an hour of data, which is longer than what was at issue in either Pharma I & II or Arson. And the nexus between the alleged criminal activity and this one-hour duration is weak. According to the affidavit, video surveillance footage shows the suspect at three discrete times. The proposed geofence’s temporal scope ranges from just before the second sighting to approximately 10 minutes after the suspect fled the scene. The affidavit does not explain why the government does not seek data from the time period surrounding the first sighting, and it does not explain why the government seeks data for the entire period between the second and third sighting.

The government will be given another chance to request this data. But it will need to provide far more information and include far more limitations than it did with its first pass. This is now the minimum expectation for reverse warrants, at least in this court.

The court… issues this opinion to provide fair notice that geofence warrant applications must sufficiently address the breadth of the proposed geofence and how it relates to the investigation. It is not enough to submit an affidavit stating that probable cause exists for a geofence warrant because, given broad cell phone usage, it is likely the criminal suspect had a cell phone. If this were the standard, a geofence warrant could issue in almost any criminal investigation where a suspect is unidentified. The Fourth Amendment requires more, particularly where the warrant implicates the privacy interests of individuals who have nothing to do with the alleged criminal activity.

If the government wants to work its way backwards to a suspect, it needs more particularity and better probable cause to do so.

Filed Under: 4th amendment, kansas, reverse warrant
Companies: google

Government's 'Reverse' Warrant Rejected By Two Consecutive Federal Judges

from the kind-of-hard-to-show-particularity-when-you're-asking-for-everyone's-dat dept

The government doesn't always get what it wants. A novel twist on mass surveillance -- the so-called "reverse" warrant -- is becoming more popular now that law enforcement has realized Google maintains a stockpile of cell location data.

Reverse warrants are just that: completely backwards. Cops don't have a suspect to target. All they have is a crime scene. Using location data allows them to work backwards to a list of suspects. Officers geofence an area around the crime scene and head to Google to ask for all information on cellphones in that area during the time the crime was committed. This treats everyone in the area as a suspect until investigators have had a chance to dig through their data to narrow down the list.

Warrants are supposed to have a certain amount of particularity. These warrants have none. All they have are some coordinates and a clock. Fortunately, as the EFF reports, some judges are pushing back.

Two federal magistrate judges in three separate opinions have ruled that a geofence warrant violates the Fourth Amendment’s probable cause and particularity requirements. Two of these rulings, from the federal district court in Chicago, were recently unsealed and provide a detailed constitutional analysis that closely aligns with arguments EFF and others have been making against geofence warrants for the last couple years.

The unsealed order [PDF] -- written by Magistrate Judge M. David Weisman -- deals with a stolen pharmaceuticals investigation. Judge Weisman has a big problem with the vast amount of data this would give investigators and the lack of limits they're willing to apply to themselves.

The warrant presented in this matter suffers from two obvious constitutional infirmities. First, the scope of the search is overbroad, and second, the items to be seized are not particularly described. As to the scope of the warrant, the government is seeking all of the data of the cellular telephones that accessed Google applications or use Google's operating system in the three requested geofrances. In this affidavit, the government asserts that approximately 97% of smartphones in the world use Google applications or Google's operating system. Moreover, the area covered by each of the geofences is large, and a majority of the area sought encompasses structures and businesses that would necessarily have cell phone users who are not involved in these offenses. Each geofence encompasses 7.7630627 acres of land. Despite the geographic and practical reach of the geofences, the government's evidence of probable cause is solely focused on one user of a cellular telephone. As to the particularity of the items for which the government can search, the warrant application is completely devoid of meaningful limitation. The application indicates the agents will be searching for "evidence or instrumentalities of" the listed offenses, but nothing more.

The judge points out the area covered by each of the three geofences is roughly the same as Wrigley Field. These geofences are being laid down in a "densely populated city" near restaurants, a large residential complex, "various commercial establishments," and medical offices.

There's no case on point the government can cite in support of this overly-broad demand for information on potentially thousands of non-suspects. What it does cite is efforts it isn't actually making, choosing instead to deploy a dragnet and work backwards to establish something resembling probable cause. The judge says the government is better off doing those things, rather than asking the court to bless a Google-aided fishing expedition.

If the government believes that the information it seeks from Google can be obtained by a grand jury subpoena (or some other process), then it should proceed in that manner. But the government seeks a search warrant and offers no justification for jettisoning the tradition standards of Fourth Amendment jurisprudence…

The government claimed that because it does not receive identifying info with the bulk batch of location records in the geofence, the warrant is still valid. Investigators use this "anonymized" data to compile a list of "suspect" devices and only then asks Google for identifying info. Therefore, according to the government, the thousands of innocent people swept up in the broad request will most likely be discarded before the hunt for suspects resumes. (This doesn't always happen.) The court doesn't agree with this assertion at all.

This argument fails on multiple levels. First, it is factually untrue. There is no objective measure that limits the agents' discretion in obtaining information as to each cellular telephone in the geofence. For example, the warrant does not limit agents to only seeking identifying information as to the "five phones closest to the center point of the geofence," or some similar objective measure of particularity.

In support of this baseless argument, the government cited the Playpen investigation, where malware was distributed by the FBI and returned identifying info from every computer that visited a dark web child porn site. The judge says targeting people who visited a site that was clearly serving up child porn is vastly different than demanding info on people who were simply working, visiting, or existing in an area where a crime was committed. The government has no right to collect data on everyone and using that as a starting point to search for suspects.

Judge Weisman rejected this application on July 8th. The government decided to edit a few things on its warrant application and run it by another magistrate. Judge Gabriel Fuentes is no more impressed than Judge Weisman. [PDF]

While the government said the Supreme Court's Carpenter decision does not apply (since it's not interested in tracking one person's movements via cell site location data), the court disagrees. Carpenter does apply because the underlying message from that decision is that the "reasonable expectation of privacy" applies to cell site location info.

[T]here is much to suggest that Carpenter’s holding, on the question of whether the privacy interests in CSLI over at least seven days, should be extended to the use of geofences involving intrusions of much shorter duration. As far as the third-party doctrine is concerned, the record before the Court suggests that device users connect to Google’s location services, or to Google applications that cause them to reveal their location information to Google, with great regularity. The Court finds it difficult to imagine that users of electronic devices would affirmatively realize, at the time they begin using the device, that they are providing their location information to Google in a way that will result in the government’s ability to obtain – easily, quickly and cheaply – their precise geographical location at virtually any point in the history of their use of the device.

This is also far more intrusive than the data at stake in Carpenter.

The proposed geofences in the Amended Application would establish the person’s physical location with far greater precision. The government did not provide a square-footage estimate, but at one location, the geofence is to be drawn around a specific business establishment and extends to the sidewalk and street outside it and to at least three residential floors above it; at the second, the geofence encompasses a business establishment and the parking lot next to it, along with at least one set of lanes of a very busy thoroughfare. The government would therefore learn precisely where the devices were used, not just within a city block or a two-mile-long stretch of that block, but within and outside of a single business establishment or set of residences on that block. The information to be generated by the proposed geofence warrant would not be an “all-encompassing record” of a person’s movements, but it is a record of almost exactly where that person was at a particular time.

The government's amended warrant -- which shrunk the geofences a bit and limited what investigators could do with the data received from Google -- still fails. It fails because it turns a bunch of innocent people into suspects, which isn't what warrants are supposed to do.

Because the proposed warrant here seeks information on persons based on nothing other than their close proximity to the Unknown Subject at the time of the three suspect shipments, the Court cannot conclude that there is probable cause to believe that the location and identifying information of any of these other persons contains evidence of the offense.

[...]

[T]he proposed warrant would grant the government far greater discretion, namely, to sort through the location information and derivative identifying information of multiple people to identify the suspect by process of elimination. This amount of discretion is too great to comply with the particularity requirement, and the proposed warrant thus suffers from the same fatal particularity flaw as did the proposed warrants in the first two applications.

This kills one geofence warrant. There are plenty more out there. Given the lack of published pushback, it appears magistrates feel these "reverse" warrants are fine because they're warrants. But those who have approved "reverse" warrants should pay more attention to Supreme Court precedent. A warrant is not a permission slip to search everyone who happens to be in a location targeted by a search warrant. Here's the EFF's summation of the Supreme Court ruling cited by Judge Fuentes:

Notably, the court looked back to the Supreme Court’s decision in Ybarra v. Illinois (1979), a case that famously established that a warrant to search a bar and a bartender didn’t give police the power to search every person who happened to be in the bar.

In essence, the geofence warrants allow the government to grab everyone in the area, seize their devices, and take a look at their location history. That the government is doing this via Google doesn't make it any less of Constitutional violation.

Filed Under: 4th amendment, law enforcement, location data, reverse warrant, surveillance

Reverse Warrant Used In Robbery Investigation Being Challenged As Unconstitutional

from the gradually-narrowed-crafting dept

Reverse warrants are being challenged in a criminal case involving a bank robbery in Virginia. These warrants (also called "geofence warrants") work in reverse, hence the nickname. Rather than seeking to search property belonging to a known suspect, investigators approach Google with a demand for information on all cellphones in a certain location at a certain time and work backwards from this stash to determine who to pursue as a suspect.

Warrants require probable cause. And there doesn't seem to be much in the way of specific probable cause supporting these fishing expeditions. In this case, a bank was robbed in the late afternoon, resulting in plenty of people unrelated to the robbery being in the vicinity. This is all it takes to turn random people into suspects. And that has gone badly for investigators and, more importantly, innocent citizens on more than one occasion.

Accused bank robber Okello Chatrie is challenging the reverse warrant that led to his arrest and indictment on federal charges. Chatrie hopes that warrant will be found deficient because it will make it easier to undo the damage he seemingly inflicted on himself after he was taken into custody.

In Chatrie’s case, bank cameras showed the robber came and went from an area where a church worker saw a suspicious person in a blue Buick. Chatrie’s location history matched these movements. Prosecutors say Chatrie confessed after officers found a gun and nearly $100,000 in cash, including bills wrapped in bands signed by the bank teller.

Chatrie first moved to suppress this warrant late last year, arguing [PDF] that it's impossible for a warrant that targets no one in particular to contain the necessary probable cause for the search of Google's location records.

This is no ordinary warrant. It is a general warrant purporting to authorize a classic dragnet search of every Google user who happened to be near a bank in suburban Richmond during rush hour on a Monday evening. This is the kind of investigatory tactic that the Fourth Amendment was designed to guard against. Geofence warrants like the one in this case are incapable of satisfying the probable cause and particularity requirements, making them unconstitutional general warrants.

His motion also points out that the location info gathered by Google via the Android operating system is far more precise than cell site location info gathered by cell service providers.

[T]he location data available in Google’s Sensorvault is even more precise than the data in Carpenter. Google can pinpoint an individual’s location to approximately 20 meters compared to “a few thousand meters” for cell site location data...

In this case, investigators received "anonymized" data on nineteen cellphones that were in the area at the time of the robbery. From there, investigators determined Chatrie to be the most likely suspect. That's detailed in the warrant application [PDF] for a search of Chatrie's Google accounts.

Based upon Google's return of anonymized information, your Affiant discovered a Google account that: (1) was near the corner of Journey Christian Church prior to the robbery at approximately 4:30 to 4:40 p.m. -- the time period [redacted] recalled encountering a suspicious individual wearing reflective glasses in a blue Buick sedan; (2) was near the southwestern corner of Journey Christian Church prior to the robbery at approximately 4:48 p.m.; (3) was inside the Credit Union during the time of the robbery; and (4) immediately left the area following the robbery, leaving from the southwestern corner of Journey Christian Church.

Chatrie filed a supplemental suppression motion [PDF] in May of this year. This one expands on points previously made, as well as adding new information gathered from a few rounds of discovery. It opens with this statement, again characterizing reverse warrants as general warrants forbidden by the Fourth Amendment -- something that doesn't become acceptable just because investigators don't have any immediate leads.

Local police had no suspects in the robbery of the Call Federal Credit Union, so they decided to enlist Google to sleuth for them. Investigators went to a Virginia magistrate and, without conveying critical information, obtained a staggeringly broad and unparticularized warrant to go fishing in a pool of private location data that most people have never heard of. They demanded the location information associated with all Google users who happened to be in the vicinity of the bank during rush hour on a Monday evening, and thus, caused Google to search numerous tens of millions of accounts at their behest.

As the motion notes, the Supreme Court has said historical cell site data is protected by the Fourth Amendment, requiring the use of a warrant to obtain it. Even though there was a warrant involved here, it did not satisfy the particularity needed to justify this search of Fourth Amendment-protected records.

While the government obtained a warrant in this case, it did not obtain one for Mr. Chatrie’s Location History data. In fact, it did not seek anyone’s data in particular. Rather, the government compelled Google to search everyone’s data in order to develop an investigative lead. This warrant was unconstitutional. It was both overbroad and lacking in particularly, a forbidden general warrant purporting to authorize a dragnet search of Google users. It did not—and could not— satisfy the Fourth Amendment’s probable cause and particularity requirements, rendering it wholly impermissible and void from the beginning.

The government's response [PDF] portrays Google as nothing more than a nearby resident who could be approached with the proper paperwork to compel it to disclose what it "saw."

The investigators were correct: Google had been a witness to the robbery. Pursuant to the warrant, Google produced to the United States a small set of records: location information over a two-hour interval of three identified and six unidentified individuals, and limited location information over a one-hour interval of ten other unidentified individuals. This information was sufficient for investigators to recognize that the defendant’s Google account likely belonged to the robber, and subsequent investigation led to his indictment.

The government says the Carpenter decision doesn't apply because -- unlike cell location data gathered by service providers -- users must opt in to allowing Google to collect their location data. The argument is an old one: that a person's agreement to share data with a company is an agreement to share data with a government.

Google could not obtain and store the defendant’s location without his undertaking multiple affirmative acts. He had to opt in to Location History in his account settings, and he had to enable Location Reporting for his phone. The defendant had discretion regarding whether Google stored his location information, and he retained the ability to delete it. And none of the services associated with Google’s storage of location information are indispensable to participation in modern society. The defendant thus voluntarily disclosed his location information to Google, and Google’s conveyance of that information to the United States did not infringe his reasonable expectation of privacy.

The government also argues that a warrant targeting nothing more than anonymized data is still somehow particular. It says warrant affidavits only need to show there's a probability that evidence will be found in the place searched.

In particular, the affidavit established: (1) that an unknown subject committed an armed bank robbery at a particular place and time; (2) that prior to the robbery, the robber held a cell phone to his ear and appeared to be speaking with someone; (3) that the majority of cell phones were smartphones; (4) that “[n]early every” Android phone “has an associated Google account,” and that Google “collects and retains location data” from such devices when the account owner enables Google location services; and (5) that Google can collect location information from non-Android smartphones if the devices are “registered to a Google account and the user has location services enabled.” From this information, there was a substantial basis for the magistrate to find probable cause to believe that Google possessed evidence related to the robbery.

The defendant argues that the warrant lacked probable cause because it “did not identify any individuals or accounts to be searched because investigators did not know who they were searching for, or even if Google would have relevant data.” However, a warrant for evidence of crime need not identify specific individuals or establish with certainty that evidence will be found—all it must do is establish a fair probability that specified evidence will be found in the place to be searched.

The judge has yet to rule on this suppression attempt. The government's arguments seek to turn a broad warrant into something that "narrowly" targets what may be a very large data subset collected and stored by Google. The implications of claiming everyone who uses Google's location services voluntarily waives their privacy right in this information are far-ranging and somewhat opposed to the Supreme Court's Carpenter decision. While the Supreme Court only delivered a narrow ruling on the warrantless acquisition of several days of cell site location info, it pointedly did not state this was the only way this decision should be applied. Other courts have already found Carpenter's reasoning capable of covering third-party records not explicitly discussed in that decision.

Finally, also of interest in the reporting on this case is that reverse warrants are the target of legislation in New York. And we have, of all people, the Proud Boys, to thank for it.

“If you are someone who went out on the streets to express your rage, your sadness and your hope that there is a better way to do policing and are then subject to a warrant, I think that would go against everything we are telling people they have the right to do,” said New York state Sen. Zellnor Myrie, a lead sponsor of a bill to ban geofence warrants.

The legislation was prompted in part by a New York Times report that prosecutors sought Google’s cellphone records around the spot where the Proud Boys, a far-right group, brawled with anti-fascist protesters in 2018. Several Proud Boys were later convicted of assault.

If this challenge ends up in a federal appeals court, more attention will be drawn to these questionable warrants that allow investigators to treat everyone in an area as a suspect by leveraging data many cellphone users may not realize is being collected and stored. And, because this is a relatively new investigative option, judges aren't being provided with all the details needed to make informed decisions, which is going to result in even more collateral damage in the future if courts don't start doing something about this now.

Filed Under: 4th amendment, okello chatrie, privacy, reverse warrant

Feds Used A 'Reverse' Warrant To Try To Track Down Bank Robbers In Wisconsin

from the doesn't-appear-to-have-worked dept

Reverse warrants are the new tech-related toy law enforcement is experimenting with. Oddly, a lot of what's come to light so far originates in the Midwest, an area not exactly known for early adoption. Outside of the NYPD and feds confirming they use warrants to seek a list of possible suspects (rather than targeting any specific suspect), most reporting has covered deployments by law enforcement agencies in Minnesota.

We can add Wisconsin to the list of areas where cops are working backwards to suspects by using the copious amount of GPS data hoovered up by Google and others. Russell Brandom of The Verge has more details:

[P]olice and federal agents have struggled to track down the bank robbers. Local media sent out pictures from the bank’s security cameras, but it produced no leads. Finally, police hit on a more aggressive strategy: ask Google to track down the bank robbers’ phones.

In November, agents served Google with a search warrant, asking for data that would identify any Google user who had been within 100 feet of the bank during a half-hour block of time around the robbery. They were looking for the two men who had gone into the bank, as well as the driver who dropped off and picked up the crew, and would potentially be caught up in the same dragnet. It was an aggressive technique, scooping up every Android phone in the area and trusting police to find the right suspects in the mess of resulting data. But the court found it entirely legal, and it was returned as executed shortly after.

The warrant [PDF] was requested by a federal agent. This doesn't rule out the use of reverse warrants by local law enforcement, but this request originated at the federal level. The feds are involved in almost every bank robbery, so the appearance of federal officers here isn't a surprise.

Nor is the use of the reverse dragnet. In this case, the submitted geofence was far more constrained than some we've seen in other cases. But considering how many people go into (or near) banks for completely innocent reasons, the GPS data/phone info of hundreds of non-bank robbers ended up in the hands of the feds. It's up to investigators to sort through the data for possible suspects and they can make mistakes. The more data investigators get, the less likely it is they'll find who they're looking for and the more likely it is they'll mistake innocent people in heavily-trafficked areas for criminals.

Right now, it's just another tool for law enforcement to use. But it's one that inverts the normal expectations of warrant procurement. Instead of targeting an individual or place, the warrants allow cops to search Google's data stores for information about anyone who wandered into a targeted area during a certain time period. This shouldn't be acceptable but there's no record of any court rejecting these broad demands for data about thousands of people no one suspects of committing crimes. Until a court steps up to shut these down, their use will continue to escalate. The problems already seen in limited use will escalate right along with them. That's bad news for cell phone users, which at this point is pretty much everybody.

Filed Under: 4th amendment, gps, location data, reverse warrant, surveillance, wisconsin
Companies: google

NYPD Used Reverse Warrants To Round Up Proud Boys Members Suspected Of Beating Antifa Members

from the bringing-Google's-data-slurping-to-a-hashtag-war dept

The first documented case of the NYPD using reverse warrants to find criminal suspects has been revealed. It made its appearance in perhaps the most 2019 of cases: the trial of two members of the Proud Boys facing assault charges for allegedly attacking members of Antifa.

Reverse warrants work this way: law enforcement agencies approach tech companies with geographic coordinates, asking for phone data for all phones within the geofenced area during a certain time frame. Using this data, law enforcement works its way backwards to probable cause, sifting through records to find what phones were in the area when the alleged crime was committed.

Obviously, this is a highly-imperfect way to track down suspects. For one, GPS data collected by companies like Google isn't exactly precise. For another, "fenced-in" areas will always contain numerous people who aren't criminals or even suspects, but the data turns them all into suspects until investigators sort them out. The more heavily-trafficked an area is, the more likely the chance officers will pursue the wrong phones/people.

This case was made a bit trickier by the victims' unwillingness to cooperate with the investigation. As George Joseph reports for Gothamist, the lack of victims to question nudged the NYPD towards deploying the legally-dubious tactic.

The use of this surveillance technique has not been confirmed in New York City until now. An investigator for the Manhattan DA revealed it during testimony last week in a case involving a politically-charged assault from last year.

The defendants are members of the Proud Boys, a group of pro-Trump rightwing extremists who allegedly beat up four leftist protesters, believed to be associated with Antifa, outside an Upper East Side event last October. The four protesters refused to cooperate with police, and authorities were unable to identify them.

According to the New York Times' account of this trial, the victims are evoked repeatedly in the court, despite no one knowing their names. This oddity has lead to the composition of sentences no one has ever read before.

The four who were assaulted refused to talk with the police. They were identified in an indictment only as Shaved Head, Ponytail, Khaki and Spiky Belt. Their whereabouts are unknown.

The two accused Proud Boys members are using the general perception of Antifa as violent to argue these attacks -- which were caught on video -- were actually acts of self-defense. The manhunt for the Proud Boys suspects may have taken the NYPD a bit longer, but the same Antifa that aggravated its own assault also provided law enforcement with plenty of useful information.

“There was a tremendous amount of what we call ‘doxxing,’” the detective, Thomas Mays, testified, using a slang term for the practice of disclosing personal information online. “Names that were given for the individuals.”

However you may feel about this comeuppance of the still-presumed-innocent Proud Boys members, the fact that the NYPD used this tactic successfully should be more than a bit chilling. Here's what the NYPD demanded from Google.

According to the investigator’s testimony, authorities were looking for location records from “Google’s Android platform and Google-based apps, such as Google Maps, [that] utilize location service[s].” The warrant requested records from multiple sites, including where the conflict broke out on 82nd Street and other locations where participants in the clash may have been that evening.

New York City is home to a densely-packed 8.6 million people. Throwing up geofences almost anywhere in the city is bound to return hundreds, if not thousands, of records that have nothing to do with the crime being investigated. At that point, the data is in the NYPD's hands and residents are at the mercy of investigators' haystack-sorting skills.

To make matters worse, if the use of reverse warrants in Minnesota is any indication, judges aren't being given enough information to make judgment calls on the mass harvesting of phone records in search of a suspect. In most cases, all they get are geographic coordinates that tell them next to nothing about the size -- or population density -- of the area targeted. And yet (or perhaps despite this), these warrants are being approved in minutes, suggesting judges are simply trusting the cops know what they're doing with all their highly-technical toys.

In the end, these warrants are surveillance dragnets that grab everyone located inside the coordinates. And it's left up to the discretion of these blue-suited fisherman to determine which of these hundreds of fish gets tossed back into the suspicion-free ocean. Reverse warrants aren't really warrants. Warrants require probable cause. Reverse warrants require only guesswork and faith.

Filed Under: 4th amendment, antifa, nypd, privacy, proud boys, reverse warrant
Companies: google

Reverse Warrant For Cell Site Location Info Results In Wrong Man Being Jailed

from the first-but-certainly-not-the-last dept

Reverse warrants are the new regular warrants. Ever since law enforcement discovered most Americans carry tracking devices with them 24/7, they've been approaching cellphone providers with warrants targeting geographic areas rather than people.

When a crime has been committed but cops don't have any suspects, they ask Google and others to canvass the area for them. Officers hand providers a geofence and ask for everyone who wandered into the selected area during a certain timeframe. Once cops have everyone, they start looking for someone.

It seems weird but it's really not all that different than sending officers out to areas around crime scenes to ask anyone if they've seen anything. The difference here is cops are getting info about people's movements in an area when they're not suspected of any criminal activity. In addition, the areas covered by warrants often include high-traffic areas like businesses and multi-family housing, increasing the chance cops are going to zero in on the wrong suspect simply because someone lives or works near a crime scene.

That's exactly what happened in Phoenix, Arizona. Detectives investigating a shooting handed a reverse warrant to Google. This data was used to arrest the wrong person, as Jennifer Valentino-DeVries reports for the New York Times.

The police told the suspect, Jorge Molina, they had data tracking his phone to the site where a man was shot nine months earlier. They had made the discovery after obtaining a search warrant that required Google to provide information on all devices it recorded near the killing, potentially capturing the whereabouts of anyone in the area.

[...]

But after he spent nearly a week in jail, the case against Mr. Molina fell apart as investigators learned new information and released him. Last month, the police arrested another man: his mother’s ex-boyfriend, who had sometimes used Mr. Molina’s car.

Police like the new tool, but acknowledge it has its limits. First, there's a lot of junk data to sort through, and not all investigators have the training necessary to make sense of these quasi-tower dumps. But that hasn't stopped them from using this option with increasing frequency. Google -- which holds up to ten years of location data in a massive database referred to by employees as the "Sensorvault" -- is now receiving up to 180 requests a week for mass location data.

Prosecutors seem cautious about the tool as well, which is a good sign. But considering what happened to Jorge Molina, this statement seems a bit too optimistic.

“It doesn’t pop out the answer like a ticker tape, saying this guy’s guilty,” said Gary Ernsdorff, a senior prosecutor in Washington State who has worked on several cases involving these warrants. Potential suspects must still be fully investigated, he added. “We’re not going to charge anybody just because Google said they were there.”

Well, maybe Ernsdorff won't. But it appears others will. The more law enforcement shoots first and asks questions later, the more often it's going to end up putting the wrong person behind bars. Like any other bulk collection, the potential to reach the wrong conclusion while sorting through haystacks is omnipresent. If Google's responding to tens of thousands of requests a year for bulk location data, Jorge Molina's story isn't going to remain an outlier for long. Certainly the tool has proven useful in other cases, but the sheer number of requests suggests law enforcement isn't using this tool cautiously. That's bad news for everyone carrying a cellphone.

Filed Under: cell site location info, csli, false arrests, jorge molina, phoenix, reverse warrant
Companies: google