Canadian Supreme Court Tightens Up Rules On Law Enforcement's Use Of Cell Tower Dumps

from the time-for-it-to-revisit-cell-phone-search-warrants dept

Matthew Braga at Motherboard reports the Canadian Supreme Court has laid down some guidelines for law enforcement's access to "tower dumps" -- call records containing every phone that accessed towers during a specified period of time. While it doesn't direct law enforcement to seek warrants, it does at least provide more restrictive guidance for collection of these data dumps, which the court originally found to be so broad as to be unconstitutional.

In his ruling, Justice John Sproat defined seven "guidelines" that law enforcement, justices, and telecommunications companies would be able to refer to when faced with future production orders for tower dump data. The guidelines recommend that such requests...

• Be tailored for minimal intrusion into subscribers' privacy.
• Explain why specific cell towers and the dates and times specified are relevant to the investigation.
• Justify the types of records requested.
• Offer any additional details that might help a telecom company narrow their search and return fewer records.
• Request "a report based on specific data instead of a request for the underlying data itself"
• Or, if a report will not suffice, justify why the underlying data is required.
• Request manageable amounts of data that can be "meaningfully reviewed."

The new approach stems from the overly-broad nature of a request made by the Peel Regional Police, which was challenged by a service provider. During the agency's investigation of a jewelry store robbery, it requested dumps from 21 towers, covering more than 43,000 phone records. (The requested information was ultimately never handed over to the police.)

While the new guidance is useful and will hopefully deter future expansive data requests (and is one step further than US courts have taken), it doesn't specifically address minimization of "non-hit" data, nor does it set a time limit for data prevention. While one Canadian privacy law (PIPEDA - Personal Information Protection and Electronic Data Act) sets limits for "organizations," law enforcement agencies do not fall under the law's definition. The court's instructions admit as much, noting the guidelines it suggests reside in a legislative black hole.

This will now sit uncomfortably within the patchwork of privacy protections granted by the Canadian court. Law enforcement must now seek warrants to obtain subscriber information from ISPs -- something it used to be able to obtain with five minutes of self-generated paperwork. That's a good step forward, but the same court has also ruled that law enforcement can search arrestees' cell phones without a warrant -- devices that contain much more information than could be obtained from an ISP or cell phone provider. Its rationale for this decision? Drugs are bad, therefore warrantless searches.

Cellphones are the bread and butter of the drug trade, the majority said in a 4-3 ruling. It said police have been given the “extraordinary power” to do warrantless searches during an arrest, under common-law rules developed by judges over centuries, because of the importance of prompt police investigations.

This moves Canada slightly ahead of the US in terms of limits on the acquisition of third party records, but behind it in terms of cell phone contents. The guidelines are a welcome addition, but the court is still a fair distance away from a coherent view on privacy expectations.

Filed Under: canada, law enforcement, phone records, privacy, supreme court, tower dumps

Warrantless Cellphone 'Tower Dumps' Becoming Go-To Tool For Law Enforcement

from the just-get-it-all,-you-never-know-when-you'll-need-it dept

Our founding fathers understood the problems with overly-broad warrants and the dangers posed by unreasonable searches and seizures. These were the sort of things kings did because the populace had no way to check that power. So, when they decided the US wouldn't be run like a patriarchal state, they built in protections for the new nation's inhabitants.

But they also understood that these checks on government power might be inconvenient for law enforcement and security agencies, which is why they built in extensive waivers and exceptions that would allow these entities to bypass the limits in order to pursue criminals, terrorists and whistleblowers. As the wording clearly states in the Bill of Rights, the people are guaranteed certain protections "unless, you know, we're trying to catch bad guys."

It's true.** Our founding fathers would be amazed to observe the ruckus being raised by so-called "defenders" of rights in the wake of the NSA leaks or the rising amount of evidence showing government agencies are willing to exploit every loophole (mainly the Third Party Doctrine) to seize tons of data completely unrelated to the investigations at hand.

**It absolutely fucking isn't.

Jess Remington at Reason points out another of these "non-events" being carried out under the name of law enforcement.

Police officers in Richland County, South Carolina are currently defending the use of a controversial investigation method that grants their departments access to thousands of cell phone users’ data in the search for criminals.

The technique, in which law enforcement officials rely on what are known as “tower dumps,” is an increasingly common policing tactic in local departments across the country. Following a crime, law enforcement officials locate nearby cell towers and request all of the call, text, and data transmissions that occurred during the crime from the tower’s provider. The majority of the data collected belongs to individuals with no connection to the crime.

How does one's info end up being swept up in a tower dump? Does one have a cellphone with a signal? Yeah, that's how. Checking your email? Surfing the web? Making a call? Sending a text message? It all goes in the dump. And South Carolina cops are helping themselves to all of this data because, hey, it makes capturing bad guys a little easier. (CAUTION: AUTOPLAY IN EFFECT)

The Richland County Sheriff's Department used Tower Dumps during the investigation into a string of car breakins, where weapons and computers were stolen. They combined the Tower Dump information with DNA evidence and in 2011 arrested Phillip Tate on three counts of "breaking and entering a motor vehicle" and one count of "larceny."

"He did break and enter into both of those vehicles, one of them being the vehicle of Sheriff Lott. It was parked at his house," said Fifth Circuit Solicitor Joanna McDuffy in court. "It was his sheriff department issued vehicle. Weapons were taken from that vehicle your honor."

Search warrants we found say Richland Sheriff's investigators requested dumps on two cell phone towers during their investigation.

Cops seeking to use these tower dumps just can't call up the provider and ask for them. But neither do they have to jump through the probable cause hoops a warrant entails. All they need is a court order, which is considerably easier to obtain than a warrant, thanks to the (somewhat ironically-named) Electronic Communications Privacy Act of 1986.

The Richland PD is just one of several law enforcement entities making frequent use of these untargeted, unminimized data dumps. And the numbers keep increasing every year.

In 2011, AT&T and Verizon received 1.3 million requests for cell phone data (many of which were tower dumps) and filled more than 500,000 of them. Verizon estimates that over the last 5 years, law enforcement’s tower dump requests have increased by 15% annually. T-Mobile reported increases of approximately 12%-16%.

Thanks to the ease of obtaining tower dumps, it's becoming a go-to tool for law enforcement. Not only can they collect these without needing to show probable cause, they're also under no obligation to inform any of the millions of unrelated cellphone customers whose information they've obtained that they've swept up their data.

Oddly enough, someone from the counterterrorism community is being the voice of reason in all this.

"In recognizing that it's not just the CIA or FBI tracking a terrorist that may have flown over here, this is local law enforcement. As citizens, we sort of have a question: how often is this happening?" said Keith Pounds, president of counterrorism consulting firm Countercon…

He supports Tower Dumps, but only if a search warrant is signed, the data is purged after an investigation is complete and law enforcement notify subscribers included in the database.

"Inform us," Pounds said. "Or at least those couple of hundred or couple of thousand people, innocent people, inform them that hey we acquired your information for this particular crime. We're going to purge the data and get rid of it."

This obviously isn't being implemented anywhere at the moment, or we would have heard of it. Law enforcement agencies are understandably in no hurry to tell innocent citizens that they're sweeping up their data in order to sift through it for potential signs of wrongdoing. They seem to be taking their cues from our nation's intelligence agencies, which only begrudgingly inform the public about their data hauls, and then only after former employees splash them all over the front pages of newspapers.

Making this worse (especially for South Carolina residents) is that local laws regarding this data tie retention rates to whether the suspect apprehended using tower dumps is convicted or not.

South Carolina evidence control laws say if a suspect is convicted or pleads guilty, police could keep everything they get from a Tower Dump for up to seven years.

So, your data's stay in SC police databases isn't subject to any minimization by process of elimination. It isn't even purged once a guilty verdict (or entered plea) is obtained. Instead, SC law enforcement has nearly a decade (or longer -- no mention of what happens if the suspect is found not guilty) to play connect-the-dots with data on non-criminals.

Even worse, this is a state that at least has some sort of policy in place to deal with this data. Most states have very little in the way of guidelines or privacy protection. Usually, these are developed post-public uproar. And if no one has to inform the public about the gathering of their data, this delays the (almost inevitable) exposure of these practices and increases the chances of abuse.

Filed Under: law enforcement, privacy, tower dumps