Appeals Court: City-Owned Utility Pulling Electric Use Info Every 15 Minutes Is A Search

from the but-an-acceptable-search-apparently dept

An oddball, but interesting, decision [PDF] flowing from the Supreme Court's Carpenter ruling has been issued by the Seventh Circuit Court of Appeals. While the Carpenter decision centered on the long term collection of historic cell site location information, the ruling could be applied to a number of situations where records created by citizens are stored and housed by other parties and accessible without a warrant.

This case deals with smart meters, issued by the government (via the public electric utility) to track electric use in citizens' homes. With the old meters, readings were performed by utility employees every few weeks. The new smart meters send back info on electric use every fifteen minutes. This frequency was chosen by the City of Naperville government. It could have gone with something less intrusive, but it chose this method instead.

The city was sued by citizens opposed to being snooped on by the new smart meters. The plaintiffs argued the frequent readings allowed to government to make a great deal of inferences about activities inside citizens' homes, based on the rolling delivery of energy use amounts. The district court tossed the case. So does the Appeals Court, but only after making some interesting findings. (via Orin Kerr/Volokh Conspiracy)

First, the court rules that the government's use of smart meters to retrieve information about electric usage is actually a search under the Fourth Amendment. To do that, it looks to the Supreme Court's Kyllo decision, which dealt with the warrantless deployment of thermal imaging scanners by law enforcement. That decision found deployment to be a search, even if officers never physically entered the residences being scanned. Enough could be inferred about inside activity from the thermal images to be considered a search under the Fourth Amendment. The Appeals Court says the same rationale applies here.

The technology-assisted data collection that Smart Meter Awareness alleges here is at least as rich as that found to be a search in Kyllo. Indeed, the group alleges that energy-consumption data collected at fifteen-minute intervals reveals when people are home, when people are away, when people sleep and eat, what types of appliances are in the home, and when those appliances are used. By contrast, Kyllo merely revealed that something in the home was emitting a large amount of energy (in the form of heat).

This search, performed by smart meters, has more privacy implications than the rough thermal imaging in Kyllo.

What’s more, the data collected by Naperville can be used to draw the exact inference that troubled the Court in Kyllo. There, law enforcement “concluded that [a home’s occupant] was using halide lights to grow marijuana in his house” based on an excessive amount of energy coming from the home. Id. at 30. Here too, law enforcement could conclude that an occupant was using grow lights from incredibly high meter readings, particularly if the power was drawn at odd hours. In fact, the data collected by Naperville could prove even more intrusive. By analyzing the energy consumption of a home over time in concert with appliance load profiles for grow lights, Naperville law enforcement could “conclude” that a resident was using the lights with more confidence than those using thermal imaging could ever hope for. With little effort, they could conduct this analysis for many homes over many years.

The court notes this isn't a Third Party Doctrine case, unlike the Supreme Court's Carpenter decision. This argument, raised by the city in its defense of its info collection, is unavailing. There is no third party. This dismantles the city's argument the data collection was somehow a "voluntary" exchange. The information flows from citizens' houses directly to the government. There's nothing "voluntary" about electric service provided by the government, and that's where the Carpenter decision comes in.

The third-party doctrine rests on “the notion that an individual has a reduced expectation of privacy in information knowingly shared with another.”But in this context, a choice to share data imposed by fiat is no choice at all. If a person does not—in any meaningful sense—“voluntarily ‘assume the risk’ of turning over a comprehensive dossier of physical movements” by choosing to use a cell phone, Carpenter, 138 S. Ct. at 2220 (quoting Smith, 442 U.S. at 745), it also goes that a home occupant does not assume the risk of near constant monitoring by choosing to have electricity in her home. We therefore doubt that Smith and Miller extend this far.

Ultimately, the court sides with government. Unreasonable searches need warrants. They're permission slips for things we don't want our government doing without permission from an impartial judge and without laying out the justification for the search. In this case, the flow of data to the government (in exchange for the flow of electricity from the government) is a search, but it's a "reasonable" search. The appeals court says that the government's interest in modernizing the grid and energy deployment is worthwhile and done "without prosecutorial intent." Law enforcement does not have constant access to this info. Only the utility does. Presumably, additional paperwork would be necessary if law enforcement does want access, but the court doesn't see anything on the record that suggests public utility shoulder surfing by police officers.

Smart meters allow utilities to reduce costs, provide cheaper power to consumers, encourage energy efficiency, and increase grid stability. We hold that these interests render the city’s search reasonable, where the search is unrelated to law enforcement, is minimally invasive, and presents little risk of corollary criminal consequences.

Somewhat strangely, the court decides that the more smart meters the government rolls out, the less of a Fourth Amendment issue it becomes.

Under Kyllo, however, even an extremely invasive technology can evade the warrant requirement if it is “in general public use.” While more and more energy providers are encouraging (or in this case forcing) their customers to permit the installation of smart meters, the meters are not yet so pervasive that they fall into this class. To be sure, the exact contours of this qualifier are unclear—since Kyllo, the Supreme Court has offered little guidance. But Kyllo itself suggests that the use of technology is not a search when the technology is both widely available and routinely used by the general public.

In the court's own words, now that airplanes are a routine part of daily life, stuff viewable from overheard has a diminished privacy interest. Apparently, the same thing applies to the continuous flow of electric usage data to government utilities. Once smart meters are no longer a niche item, Americans will just have to get used to the government drawing inferences from the multiple data points it gathers daily.

This seems at odds with the Carpenter decision (which partially stems from the Supreme Court's ruling on cellphone searches). The more pervasive the tech is, the more privacy implications it raises. Once cellphones became ubiquitous, the government could no longer be allowed to treat them as tracking devices loaded with personal information that could be accessed without a warrant.

The tech in this case may be owned by the government, but the same thought process should apply. Turning peoples' homes into a steady stream of data points via the rollout of smart meters should weigh against the government's easy access, rather than be treated as a supporting argument for it. But that's the way the Supreme Court precedent sits right now, which makes for some very inconsistent Fourth Amendment applications.

Filed Under: 4th amendment, 7th circuit, carpenter, electric utility, naperville, smart meters

Smart Meter Company Landis+Gyr Now Using Copyright To Try To Hide Public Records

from the what-they-don't-want-you-to-see dept

Back in 2016 we wrote about how Landis+Gyr, a large multinational company owned by Toshiba, completely freaked out when it discovered that documents about its smart energy meters, which the city of Seattle had contracted to use, were subject to a FOIA request. As we noted, Landis+Gyr went legal and did so in perhaps the nuttiest way possible. First it demanded the documents be taken down from Muckrock -- the platform that makes it easy for journalists and others to file FOIA requests. Then it demanded that Muckrock reveal the details of anyone who might have seen the documents in question. It then sued Muckrock and somehow got a court to issue a temporary restraining order (TRO) against Muckrock for posting these public records.

Eventually, with help from EFF, Landis+Gyr agreed to a settlement that stated that these documents were (a) public records and (b) the company would no longer attempt to take down the copies that Muckrock had obtained. From the settlement agreement posted on the public docket in the case:

Plaintiffs agree that they will take no further action against Defendants Mocek, Muckrock.com, and Morisy with respect to two public records previously released by the City to Muckrock.com on behalf of Mocek and automatically published on MuckRock.com.

This all ended in the summer of 2016. And, indeed, you can still find the documents hosted on Muckrock's website today. Here is the Managed Services Report 2015 and the Security Overview. Even though Landis+Gyr went to court over this and then agreed via its settlement that (1) these were public records that (2) could be left online, the company apparently doesn't want you reading them.

Last week, we received a notice from DocumentCloud -- which we use to host various documents as part of our reporting efforts -- that it had received a DMCA notice from lawyer Heather McNay of Landis+Gyr, demanding that it take down the copies of those very same public records that we had uploaded as part of our reporting on this story. It seems fairly clear to us that our posting of these public records as part of our reporting and commentary on a dispute created by Landis+Gyr itself was quintessential fair use for news reporting. And, of course, there a number of court rulings in various locations noting that copyright law cannot be used to prohibit the copying of public records (notably, that case involves a very similar situation involving a public records request in Washington State).

Either way, given that Landis+Gyr has promised in its settlement with Muckrock not to take any actions at all against Muckrock for hosting these public records, we'll note the incredible futility of the company then sending DMCA notices targeting those same public records, and scratch our collective heads over what the company is thinking when all it's doing is reminding everyone that (1) these documents exist online and (2) apparently the company would prefer you not look at these public records about its own systems.

Filed Under: censorship, copyright, fair use, foia, free speech, public records, seattle, smart meters
Companies: landis+gyr, toshiba

EFF: Data Collected From Utility Smart Meters Should Be Protected By The Fourth Amendment

from the I-always-feel-like-somebody's-watching-me dept

For years, electric utilities have increasingly embraced smart meters. Roughly 65 million of the devices have been installed in the United States over the last few years, with 57 million of them in consumer homes. The meters provide innumerable benefits to utility companies, often delivering an ocean of new remote access and monitoring tools to better manage the network and reduce meter reading truck rolls. The benefits to consumers (outside of accuracy) have been less notable, including interference with some home routers, as well as the fact that a number of models have been shown to be relatively easily hacked.

In addition to hackability, the sheer volume of data being gobbed up by utility companies tells an awful lot about you (when you wake, when you sleep, when you're home or away). This has, at times, sparked outrage from locals in places like Naperville, Illinois, where, since 2011, meter opponents have been fighting the intrusive nature of the devices:

"...Opponents say the meters provide so much information that everyone from cops to criminals to marketing departments can learn when people are home and what they do when they're there. Last year, the anti-meter movement fell just short of collecting enough signatures to place a question on the ballot asking residents to decide whether the devices should be removed. They also have a pending federal lawsuit against the city alleging that their constitutional right to due process has been violated."

That was 2013. In 2015, the city of Naperville was forced to settle with one smart meter opponent after she sued the city and four of its police officers for violating her constitutional rights. That same year, another man sued the city over what he claimed was an unwarranted search into his home. But last fall, a federal district court in Illinois declared that Americans can't reasonably expect any privacy in the data collected by these devices, and utility collection of it is completely beyond the protection of the Fourth Amendment.

That case is currently on appeal to the United States Court of Appeals for the Seventh Circuit. And the EFF and Privacy International have asked the Seventh Circuit if they can weigh in on the case. In a blog post, the EFF points out that the court's decision was based on a misunderstanding of how the technology actually works. Basically, the court assumed that these new meters work in exactly the same way as their older counterparts, ignoring the significantly-expanded data collected:

"The court was convinced that data collected from smart meters is no different from data collected from analog meters, in terms of what it reveals about what’s going on inside the home. But that’s simply not the case. Smart meters not only produce far more data than analog meters—those set at collecting data in 15-minute intervals produce 2,880 meter readings per month compared to just one monthly reading for analog meters—but the data is also far more intimate. A single monthly read of cumulative household energy use does not reveal how energy is being used throughout the course of a day. But smart meter data does. And its time granularity tells a story about what is going on inside the home for anyone who wishes to read it."

As we've seen with cellular location data, once companies collect this information, it's often sold to any number of third parties who may be using this data in ways that aren't always in your best interests. But as Tim Cushing has occassionally noted, getting companies to be forthcoming about what they're collecting and who they may be selling it to is sometimes difficult, with at least one company suing to thwart transparency efforts on the subject in Seattle. And as Glyn Moody has also noted, this collision between privacy rights and utility data collection on the smart meter front isn't just an American phenomenon.

Filed Under: 4th amendment, illinois, naperville, privacy, smart meters

UK Government Says Smart Meters Can Definitely Be Trusted Because GCHQ Designed Their Security

from the oh,-that's-OK,-then dept

The idea behind smart meters -- that detailed information about how you consume electricity will allow you to use power more efficiently and thus cut your bills and your home's carbon emissions -- is a good one in theory. And yet smart meters are still not used very widely, even in countries like the UK, where the government has a strategy to install millions of them by 2020. Actually, the likely savings by users are small, but smart meters also promise to allow the electricity industry to lower salary costs by carrying out meter readings remotely, which is one reason why it is so keen on the idea. Another is because smart meters make it is easy to cut off someone's supply if they don't pay their bills.

The slow uptake of smart meters seems in part to be due to public concerns about security. People are worried that their smart meter will spy on them, sending back information to electricity companies that might be intercepted and used for targeted burglary when they are away. Similarly, there are fears that if the smart meter control system were compromised, domestic electricity supplies might be at risk on a large scale.

One of UK Parliament's most important committees, the one monitoring science and technology, has just published a report into the UK smart meter roll-out, offering recommendations for ways to speed it up. Security is an issue it discusses, and one of the committee's recommendations is as follows:

We recommend that the Government consider further how to communicate the level of thought that has gone into designing a secure system for smart metering

More about that "level of thought" is found in an appendix to the report, which contains the UK government's evidence on this topic, including the following statement:

The Department of Energy and Climate Change (DECC) has worked with GCHQ since the very early design stage of the rollout, when the programme was initiated. The engagement with GCHQ has been one of partnership, issue discussion and resolution.

Helpfully, GCHQ has written a long and interesting description of its work on smart meters, and how it has tried to make UK smart meters resistant to attack. The post concludes:

We hope that this article has explained the thinking behind the design of the Smart Metering System. DECC, with support from GCHQ (part of which will be become the National Cyber Security Centre) has security right at the top of the list of things it cares about. Of course, no system is completely secure, and nothing is invulnerable. However, we’re confident that the Smart Metering System strikes the best balance between security and business needs, whilst meeting broader policy and national security objectives.

It's interesting that the post mentions national security objectives. As Techdirt has reported, one of the worst features of the UK's Investigatory Powers Bill that is currently wending it way through Parliament is that it creates a legal framework to allow GCHQ and the other intelligence agencies to hack into any kind of equipment in order to carry out surveillance. Of course, that's really rather easy when you were the one who designed its security systems.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: gchq, security, smart meters, surveillance, trust, uk

Court Dumps Hastily-Granted Restraining Order, Says MuckRock Can Publish Smart Meter Documents

from the prior-restraint-much? dept

It took a little less than a week, but the EFF, with the invaluable assistance of Venkat Balasubramani of FOCAL PLLC, has persuaded a Washington state judge to strike down the temporary restraining order against MuckRock he hastily granted back on May 27th.

Landis+Gyr, a multinational corporation owned by Toshiba, recently secured a contract to upgrade Seattle's "dumb" meters to smart meters. Privacy activist Phil Mocek requested information on the city's smart meter plan through MuckRock and was handed two Landis+Gyr documents in unredacted form by the city.

These documents worth suing over spent a month uploaded to MuckRock before Landis+Gyr took notice. Once it had secured the city contract, L+G then demanded -- via a request for a temporary restraining order -- that MuckRock take the documents down, turn over info on site users who may have seen/downloaded them, and somehow help L+G shove its smart meter genie back into the bottle.

Fortunately, the judge has now struck down the restraining order he issued earlier in the week.

Agreeing with EFF, King County Superior Court Judge William Downing ruled that the previous order amounted to a prior restraint on speech that violated the First Amendment, and rescinded it along with denying plaintiffs’ request to extend it.

Not that Landis+Gyr didn't try to keep its restraining order alive -- despite openly acknowledging that one of the two documents contained nothing worth withholding. In its final attempt to salvage its request, L+G claimed that an internet full of evildoers now has access to sensitive information that could place citizens in danger.

Defendants knowingly posted Landis+Gyr’s protected information on its publicly-accessible website, where Landis+Gyr’s competitors, as well as hackers and saboteurs, had access to the information. In fact, internet traffic surrounding the disclosure reveals the danger caused by Defendants’ refusal to remove the information. See Second Supplemental Declaration of Eric Lee Christensen in Support of Motion for Preliminary Injunction, ¶¶ 2, Exhs. A. (“I read all your secret information, you [expletives deleted]”), ¶ 4, Exh. C, p. 8 (“visit the link below to download disputed documents”).

Without access to the exhibits, I can only assume the deleted expletives were "censorious asshats" and that "visit the link below to download disputed documents" is internet code for "seize the means of production, starting with the power grid."

Landis+Gyr's fears of terrorism are overblown, if these are the best pull quotes it could find to illustrate its "hackers n' saboteurs" theory. It may be that its trade secret claims are more based in reality, but that still doesn't explain its attempt to silence a third-party FOIA clearinghouse for doing nothing more than publishing documents handed to it by a government body.

Filed Under: foia, prior restraint, seattle, smart meters, streisand effect
Companies: eff, landis+gyr, muckrock

Court Says MuckRock Must Take Down Smart Grid Company's Documents Because Judge Has 'No Time' To Review Case Properly

from the ain't-nobody-got-time-to-consider-free-speech-implications dept

Last week, we covered a multinational corporation's attempt to force MuckRock to take down documents supplied by the city of Seattle to Phil Mocek. Landis+Gyr, which was awarded the contract to supply the city with "smart meters" in conjunction with the publicly-owned utility, claimed the documents released -- along with documents the city was planning to release -- would be a boon to competitors and terrorists, although it didn't specify which of these it was more worried about.

The company also demanded MuckRock turn over information on site users who may have seen or downloaded the documents. It also (hilariously) demanded MuckRock assist it in the "retrieval" of disseminated documents.

The company's request for an injunction against MuckRock and the city of Seattle went before a judge on Thursday. It has been (partially) granted. Ansel Herz of The Stranger says, after speaking to Landis+Gyr reps, that the judge granted its request -- not on its merits but because there just aren't enough hours in the day.

At a King County court hearing yesterday, Commissioner Carlos Velategui granted the companies' request for a temporary restraining order, lawyers for the companies told me. "There's no way that I can spend the time to look at all this," Velategui said. Neither Mocek nor the city showed up to defend themselves.

The request was filed on the 23rd and granted on the 26th. That's an impressive turn radius for government machinery. This compressed timeframe likely explains the court's harried decision, as well as the lack of defendants in the courtroom.

MuckRock will be fighting the order, but it will now have help. The EFF has stepped in to represent MuckRock and Mocek against Landis+Gyr (Update: Mocek notes in our comments that EFF has only offered to help MuckRock so far). The documents MuckRock is currently unable to provide to the public can be found here: L+G Managed Services Report and L+G Security Overview (in case you want a copy).

Landis+Gyr may have achieved the first step in its plan to herd its PDF cats back into the bag, but its complaint should have been limited to the government organization that released the documents it claims are sensitive, rather than the FOIA requester and clearinghouse that received them. And, trade secrets or not, the company is working in conjunction with a city government to install devices with possible privacy implications on every home -- so more transparency, not less, is exactly what's needed.

Filed Under: carlos velategui, foia, injunction, phil mocek, prior restraint, seattle, smart grid, smart meters
Companies: landis+gyr, muckrock

'Smart Grid' Company Demands MuckRock Turn Over Info On Anyone Who Might Have Seen Public Records Docs Involving It

from the because-trade-secrets-and-terrorism dept

Earlier this year, FOIA enthusiast/privacy activist Phil Mocek requested documents from Seattle City Light, the city's public-owned utility. Mocek was seeking info on the utility's proposed "smart meter" system, which carried with it some obvious privacy implications.

Pursuant to RCW Ch. 42.56 (Public Records Act), I hereby request the following records:

Plans for, schedules of, policies dictating the performance of, requests for proposals to, contracts for, discussion of, and results of all security audits performed of "smart meter" devices (remotely-addressable electrical meters sometimes referred to as "advanced metering infrastructure"), along with metadata. These devices are designed to replace traditional electric meters. They contain sensors that monitor activities inside subscribers' premises and automatically communicate information collected by those sensors to machines in remote locations.

The replacement of regular meters with potentially-invasive "smart meters" is due to begin in 2017, despite concerns about health and privacy. As the EFF points out, the power company's ability to record pinpoint data on customers' power use may seem innocuous, but it's not nearly as benign if that information is shared, either purposefully or inadvertently.

It’s not just utilities who will have access to your data.   It’s potentially a series of third party corporations including (but not limited to) the utility’s contractors and government agencies. Law enforcement agencies in particular are very keen to be able to see this information. There have already been a lot of cases where utility records have been provided to police who use them to bust marijuana growing operations, and this is simply using the raw energy use data.

[...]

Insurance companies and employers might also be interested in your personal energy usage information. Smart meters crack open this door into your private life, making available a huge amount of very personal data.

And that's not even factoring in the unauthorized uses that smart meters may inadvertently lead to if not secured properly.

Multiple documents were provided to Mocek by Seattle City Light, including documents related to the company awarded the smart meter contract: Landis+Gyr. Landis+Gyr isn't happy the city of Seattle has made these documents public, so it's logically responded by suing MuckRock. Yes, it's also suing the city and the utility, but for some reason has decided MuckRock (and Phil Mocek) should be included in the litigation, despite them only being the recipients of documents Landis+Gyr wants to keep out of the public's hands.

It's seeking to have future planned responses from the city involving its "trade secrets" blocked. (Seattle plans to release another batch of documents to Mocek on May 26.) But it's also making requests pertaining to MuckRock that are both chilling and completely ridiculous. Not only does Landis+Gyr want the documents taken down, but it also wants info on every MuckRock reader who may have viewed them.

[A]fter receiving certain unredacted documents through inadvertent, accidental, or improper release by the City in circumstances demonstrating that Defendants knew or should have known the documents contain sensitive network security information and trade secret information, Mocek nonetheless allowed the information to be posted publicly and in unredacted form on the internet site of Defendant MuckRock.com. Plaintiff Landis+Gyr notified Mocek, MuckRock.com, and Defendant Michael Morisy of the apparent error and requested that Landis+Gyr’s sensitive and proprietary information be removed from the MuckRock.com website and that MuckRock.com provide reasonable assistance to allow Landis+Gyr to identify entities that may have obtained access to is sensitive information.

Michael Morisy refused Landis+Gyr's first request. Now, it's upped the ante by petitioning the court to force MuckRock to assist it in the ultimate fool's errand: the removal of information from the internet.

Immediate relief is needed to require Plaintiffs’ protected information to be immediately taken down from the MuckRocks website, to require MuckRock.com to provide assistance to Plaintiffs to identify and retrieve protected information that may have been downloaded from the MuckRocks website…

If that wasn't enough, the multinational corporation would like the government to engage in a little prior restraint on its behalf.

[...] enjoin Mocek and MuckRock.com from posting Plaintiffs’ protected and sensitive information in the future.

Landis+Gyr seems to be most concerned about the pending release of documents containing pricing info and details about its "smart grid" technology. But, it's also demanding the removal of the two documents already released, both of which are fairly innocuous (and can be viewed below!) As MuckRock's Michael Morisy points out, it should be under no obligation to remove the documents as it's received no notice from the city of Seattle that the documents it has in its possession weren't supposed to be released.

Morisy and MuckRock don't plan to back down.

We believe that these legal threats are a chilling attack on free speech and we will not be complying with their demands.

We also believe people have a broad right to understand the security implications of technology purchased by their governments, particularly if, as is the case with the smart electrical meter systems provided by Landis+Gyr, that technology monitors the activities of people in their homes.

At this point, the injunction doesn't appear to have been granted, which means MuckRock can still (for the time being) host the docs it has already obtained as well as anything else Landis+Gyr-related Seattle sends to Mocek while its request is being reviewed.

Filed Under: foia, phil mocek, seattle, smart grid, smart meters, threats
Companies: landis+gyr, muckrock