Warrantless Collection Of Cellphone Data By Law Enforcement On The Rise, As Is The Use Of Stingray Tower Spoofers

from the millions-of-'incidental'-records dept

As we covered last week, cellphone tower "dumps" are increasingly being used by law enforcement to track criminals. These "dumps" provide LEOs with the information gathered every time someone's cell phone contacts the tower, whether it's to make a call, send a text or email or access the web.

This vast amount of data being sought is obtained with a court order, which has a much lower bar than a search warrant, which requires probable cause. The ease in which this data is obtained is one concern. The other concern is that many law enforcement agencies have little to nothing in the way of guidelines for dealing with this collected data -- often allowing it to be stored for years, completely unmiminized. Agencies also are under no obligation to inform citizens that their data has been collected.

USA Today has compiled some more information about how these tower dumps are used, as well as on how common they are becoming. As was noted in our original article, requests for these data dumps has jumped over 75% over the last five years (according to Verizon) and more than 1.3 million requests were made in 2011 alone (Verizon and AT&T combined).

Here's how one particular case utilized data dumps to search for a suspect.

In October 2012, in Colorado, a 10-year-old girl vanished while she walked to school. Volunteers scoured Westminster looking for Jessica Ridgeway.

Local police took a clandestine tack. They got a court order for data about every cellphone that connected to five providers' towers on the girl's route. Later, they asked for 15 more cellphone site data dumps...

The tower dump data helped police choose about 500 people who were asked to submit DNA samples. The broad cell-data sweep and DNA samples didn't solve the crime, though the information aided in the prosecution. A 17-year-old man's mother tipped off the cops, and the man confessed to kidnapping and dismembering the girl, hiding some of her remains in a crawl space in his mother's house. He pleaded guilty and last month was sentenced to more than 100 years in prison.

To sum up, tons of data was collected, resulting in a broad sampling of 500 people's DNA, and yet it was an old-fashioned tip that resulted in the arrest and indictment of the suspect. What should be considered a troubling incursion on our civil liberties is viewed by law enforcement as just another tool in the toolset, albeit one that goes long on data and comes up short on results.

From this lowered bar (court orders), police use previously obtained cellphone tower dumps as justification for even more tower dumps, along with any other information that they can gather without having to obtain a warrant: home addresses, call records, locations and the content of texts. This data is combined with the info gathered by other surveillance technology, including plate readers and traffic cams, to generate very precise recreations of a person's actions and movements -- all without a warrant or any concern for the amount of unrelated data gathered.

The intrusion goes even deeper than bulk data dumps, though.

Local and state police, from Florida to Alaska, are buying Stingrays with federal grants aimed at protecting cities from terror attacks, but using them for far broader police work…

Typically used to hunt a single phone's location, the system intercepts data from all phones within a mile, or farther, depending on terrain and antennas.

Stingray devices give law enforcement agencies roaming cell tower impersonators to grab even more data with, bypassing both search warrants and the wireless providers themselves.

Law enforcement agencies don't want to talk about these devices, something the manufacturer has an active hand in.

Initially developed for military and spy agencies, the Stingrays remain a guarded secret by law enforcement and the manufacturer, Harris Corp. of Melbourne, Fla. The company would not answer questions about the systems, referring reporters to police agencies. Most police aren't talking, either, partly because Harris requires buyers to sign a non-disclosure agreement.

Beyond not wanting to talk about the devices, agencies are also reluctant to discuss what guidelines (if any) they have in place to help safeguard civil liberties. As it stands now, most of these devices are deployed covertly, with citizens having no idea their local law enforcement even possesses this capability.

Documents obtained by Indianapolis Star indicate the Indiana state police own a Stingray device valued at nearly $375,000. Unsurprisingly, the state police have no interest in discussing this purchase.

[O]fficials at Indiana’s largest police agency aren’t saying what they do with the technology; they’re mum on whose data they’ve collected so far; and they’re not talking about what steps they take to safeguard the data.

Citing concerns that releasing any information would endanger public safety by hindering the agency’s ability to fight crime and combat terrorism, they won’t even say whether they ask a judge for a search warrant before they turn the equipment on.

There it is again -- concerns about intrusive technology and untargeted data hauls being waved away by throwing out the word "terrorism" and claiming that revealing any information would "endanger public safety." It's a cop-out -- one that dodges every potential issue by appealing to fear.

The reality is that very few people know how these are being deployed. The power of the device lends itself to abuse, or at the very least, overuse. As the article points out, police in South Carolina used tower dumps to investigate items being stolen from vehicles and in Miami, the police department deployed a Stingray to spy on protesters at a world trade conference.

According to the documents, 25 police departments around the country have contracts with Harris Corp. These devices may be expensive, but utilizing the word "terrorism" when applying for a grant from the DHS generally makes the tech more affordable. These devices also appear to be loaned out freely to other agencies, meaning the actual count of law enforcement agencies with access to this technology is considerably higher than the 25 listed.

This unofficial sharing program vastly increases the amount of data gathered -- as well as the potential for the civil liberties violations. While one agency may have guidelines affecting use and destruction of gathered data, the agency borrowing it may have nothing in place at all. And, considering the fact that no agency wants to talk about their usage of Stingrays, it's safe to assume whatever safeguards are in place are lax and full of loopholes.

Outdated laws have combined with expansive readings of the Third Party Doctrine to give law enforcement agencies nearly unlimited access to vast amounts of data. The rise of cellphones has been fortuitous for agencies with unquenchable thirsts for data, providing millions of metadata points for millions of users. And, like our intelligence agencies, these law enforcement agencies are operating largely under the cover of "darkness," actively avoiding (or directly thwarting) any attempts at oversight.

Filed Under: abuse, cell tower data, law enforcement, mobile phones, privacy, stingray

Cell Phone Manufacturers Offer Carefully Worded Denials To Question Of Whether NSA Can Track Powered-Down Cell Phones

from the it's-not-so-much-what's-being-said,-it's-how-it's-being-said dept

Back in July, a small but disturbing detail on the government's cell phone tracking abilities was buried inside a larger story detailing the explosive expansion of the NSA post-9/11. Ryan Gallagher at Slate pulled this small paragraph out and highlighted it.

By September 2004, the NSA had developed a technique that was dubbed “The Find” by special operations officers. The technique, the Post reports, was used in Iraq and “enabled the agency to find cellphones even when they were turned off.” This helped identify “thousands of new targets, including members of a burgeoning al-Qaeda-sponsored insurgency in Iraq,” according to members of the special operations unit interviewed by the Post.

Ars Technica reports that some security researchers are calling this statement into question and have contacted cell phone providers for statements on the NSA's claim. Only a few have responded at this point, and their denials have been worded very specifically.

Google had this to say:

When a mobile device running the Android Operating System is powered off, there is no part of the Operating System that remains on or emits a signal. Google has no way to turn on a device remotely.

Google may not have a way, but that doesn't mean the NSA doesn't.

Nokia:

Our devices are designed so that when they are switched off, the radio transceivers within the devices should be powered off. We are not aware of any way they could be re-activated until the user switches the device on again. We believe that this means that the device could not be tracked in the manner suggested in the article you referenced.

Once again, we're looking at words like "should" and "not aware." This doesn't necessarily suggest Nokia does know of methods government agencies could use to track phones that are off, but it doesn't entirely rule it out either.

Samsung's response is more interesting. While declaring that all components should be turned off when the phone is powered down, it does acknowledge that malware could trick cell phone users into believing their phone is powered down when it isn't. Ericsson, which is no longer in the business of producing cell phones (and presumably has less to lose by being forthright), was even more expansive on the subject.

The only electronics normally remaining in operation are the crystal that keeps track of time and some functionality sensing on-button and charger connection. The modem (the cellular communication part) cannot turn on by itself. It is not powered in off-state. Power and clock distribution to the modem is controlled by the application processor in the mobile phone. The application processor only turns on if the user pushes the on-switch. There could, however, be potential risks that once the phone runs there could be means to construct malicious applications that can exploit the phone.

On the plus side, the responding manufacturers seem to be interested in ensuring a powered down phone is actually powered down, rather than just put into a "standby" or "hibernation" mode that could potentially lead to exploitation. But the implicit statement these carefully worded denials make is that anything's possible. Not being directly "aware" of something isn't the same thing as a denial.

Even if the odds seem very low that the NSA can track a powered down cell phone, the last few months of leaks have shown the agency has some very surprising capabilities -- some of which even stunned engineers working for the companies it surreptitiously slurped data from.

Not only that, but there's historical evidence via court cases that shows the FBI has used others' phones as eavesdropping devices by remotely activating them and using the mic to record conversations. As was noted by c|net back in 2006, whatever the FBI utilized apparently worked even when phones were shut off.

The surveillance technique came to light in an opinion published this week by U.S. District Judge Lewis Kaplan. He ruled that the "roving bug" was legal because federal wiretapping law is broad enough to permit eavesdropping even of conversations that take place near a suspect's cell phone.

Kaplan's opinion said that the eavesdropping technique "functioned whether the phone was powered on or off." Some handsets can't be fully powered down without removing the battery; for instance, some Nokia models will wake up when turned off if an alarm is set.

While the Genovese crime family prosecution appears to be the first time a remote-eavesdropping mechanism has been used in a criminal case, the technique has been discussed in security circles for years.

Short of pulling out the battery (notably not an option in some phones), there seems to be little anyone can do to prevent the device from being tracked and/or used as a listening device. The responding companies listed above have somewhat hedged their answers to the researcher's questions, most likely not out of any deference to government intelligence agencies, but rather to prevent looking ignorant later if (or when) subsequent leaks make these tactics public knowledge.

Any powered up cell phone performs a lot of legwork for intelligence agencies, supplying a steady stream of location and communications data. If nothing else, the leaks have proven the NSA (and to a slightly lesser extent, the FBI) has an unquenchable thirst for data. If such exploits exist (and they seem to), it would be ridiculous to believe they aren't being used to their fullest extent.

Filed Under: mobile phones, privacy, surveillance, tracking
Companies: ericsson, google, nokia, samsung

Patent Troll Shell Company Owned By Microsoft And Apple Launches Massive Patent Attack On Android

from the but-of-course dept

About a year and a half ago, we wrote about "Rockstar Consortium," a shell company set up by Apple and Microsoft (and a few other companies), in which they placed many of the patents they received when they outbid Google to get Nortel's patents. We noted at the time that one of the reasons regulators let Apple, Microsoft, RIM and others team up to buy these patents without it being an antitrust concern was that they promised that all the patents would be able to be licensed on "reasonable terms." Except... once they handed them off to Rockstar, that company's CEO, John Veschi, noted that this promise "does not apply to us."

So, in a move that surprises basically no one, Rockstar Consortium has sued Google along with most of the major Android phone makers (Asustek, HTC, Huawei, LG Electronics, Pantech, Samsung, and ZTE) claiming they violate a bunch of those old Nortel patents. This is yet another example of the obnoxious practice of privateering patents, where operating companies shuffle patents off to troll shell companies, to avoid having countersuits launched against their own products. It's pretty obvious that the lawsuits, two of which are listed below, are nothing more than Microsoft and Apple trying to put a dent in Android.

This has nothing to do with patents as innovation, and everything to do with patents trying to stifle competition. Again.

Filed Under: android, patents, troll
Companies: apple, google, microsoft, nortel, rockstar consortium

Texas Judge Forced To Resign After Being Caught Texting Instructions To Assistant DA During Trial

from the a-broken-system-suffers-another-set-of-fractures dept

Oh, the hilarity that is the phrase "criminal justice system." Talk to any defense attorney and they'll tell you how the deck is stacked against defendants and defense lawyers. The ideal of "innocent until proven guilty" has become little more than a disclaimer tacked onto cop-centered reality shows. Defendants are guilty until the jury is somehow tricked by the defense into handing down a "not guilty" verdict. A lot of effort goes towards dissuading defendants from even making it this far, as prosecutors will present worst-case scenarios comprised of every violation conceivable in order to get an agreement to plead guilty to a lesser charge.

The prevailing perception that the person charged is guilty, with the only answer yet to be determined is how guilty, makes defending arrestees an uphill battle. Judge (former judge) Elizabeth Coker took this uphill battle, increased the grade to 85 degrees, covered it with a sheet of ice and sprinkled it with a 50/50 blend of Teflon and motor oil.

Elizabeth E. Coker may forever be known as the "texting judge," but her notoriety will soon be all that is left of her days on the bench of the 258th District Court of Polk, Trinity, and San Jacinto Counties. Coker signed an "AGREEMENT TO RESIGN FROM JUDICIAL OFFICE IN LIEU OF DISCIPLINARY ACTION" with the State Commission on Judicial Conduct…

The agreement comes in the wake of a recent investigation revealing Coker texted instructions from the bench to a Polk County Assistant District Attorney who was assisting in the prosecution of a case in Coker's court.

The good news is that Coker is being stripped of all of her judicial power. Once the resignation goes through, she won't even be able to perform a wedding. The bad news is that this texting incident was only one of several alleged incidents in which Coker undermined the justice system. [Perhaps someone should have passed her, and any prosecutors dealing with her courtroom, a copy of this letter from a Texas DA warning his staff away from ex parte discussions...]

[J]udge Coker used Assistant District Attorney Jones to privately communicate information about the Reeves case to the assistant district attorney prosecuting the case; to suggest questions for the prosecutor to ask during the trial; to ensure that a witness was able to refresh his memory and rehabilitate his testimony by reviewing his videotaped interview with law enforcement before he took the stand for the second time the following day; and to discuss legal issues pertinent to the case. in an unsuccessful effort to assist the State obtain a guilty verdict in the case…

[t]he Commission investigated claims that Judge Coker allegedly engaged in other improper ex parte communications and meetings with Jones, other members of the Polk County District Attorney's Office, the San Jacinto County District Attorney, and certain defense attorneys regarding various Cases pending in her court; Judge Coker allegedly exhibited a bias in favor of certain attorneys and a prejudice against others in both her judicial rulings and her court appointments: and Judge Coker allegedly met with jurors in an inappropriate manner, outside the presence of counsel, while the jurors were deliberating in one or more criminal trials…

Add to all the alleged misconduct above the apparent fact that she kept using the same questionable tactics right up to her appearance before the Commission.

[t]he Commission also expressed concerns that Judge Coker discussed the Commission's investigation and Judge Coker's written responses to the investigation with a material witness prior to that witness' testimony before the Commission in an apparent attempt to influence that witness, and that the judge may not have been candid and truthful in her testimony before the Commission when questioned about her contact with the witness...

In addition to stripping her judicial powers, the Commission also leaves her solely responsible for bearing the cost of any litigation arising from her alleged misconduct. The Commission, however, chose not to pursue these allegations in exchange for her immediate resignation. Coker utilizes that out in her public statement.

"The Judicial Commission made no finding or determinations of fact in my voluntary resignation, and I have not admitted guilt, fault or liability in my voluntary resignation. While I could have fought these allegations, it would have involved significant time, significant expense, and disruption to everyone involved. I did not feel that was in the best interests of the taxpayers, our court system, my family or myself" Coker stated.

Yeah, that sounds about right. Coker sacrificing herself for the good of a long list of others, including the taxpayers who paid her salary and the court system she allegedly abused from a position of power. Thanks to the commission's decision, these will forever remain allegations -- the equivalent of "getting off on a technicality." If Coker ends up in court because of her previous improprieties, I would imagine she'll have to search well outside her district for a defense lawyer.

Filed Under: elizabeth coker, judges, texting

T-Mobile Bucks Another Crazy Mobile Phone Trend: Dumps International Roaming Charges

from the well,-look-at-that dept

For pretty much the entire history of the mobile phone business, your choice of service providers was mostly dependent on trying to find the least evil provider. They all played the same awful tricks designed to make you pay more -- and to hate your service provider in the process. Could it possibly be that T-Mobile has finally decided that it's going to become the brand that completely shakes that up? Last year we wrote about the company killing off the abusive practice of long term contracts combined with subsidies that actually made you pay much more for your phone while making people think they were paying less. And now they've hit back on one of the other favorite gouging places for mobile phone carriers: positively insane international roaming fees that resulted in numerous stories of people suddenly receiving bills over $10,000.

T-Mobile's response isn't to just lower the international roaming fees, it's to get rid of them completely, replacing them with free data access in most countries, and relatively cheap phone calls. The free data plan is fairly slow, but you can upgrade to pay for a faster plan at non-crazy rates (about $15/day -- which is actually less than many hotels charge for WiFi). While other mobile carriers have "international plans" it looks like, even if you're paying up for the "higher levels" of service, T-Mobile's plans will come out significantly cheaper than any competitor.

I'm not sure my brain can process the idea of a mobile phone company that doesn't suck and focus on customer disservice over customer utility.

Filed Under: international roaming, mobile phone service
Companies: t-mobile

DA Claims Mobile Phone Obsession Resulted In No One Noticing Guy With Gun On SF Train

from the or,-you-know,-people-keeping-to-themselves dept

The San Francisco Chronicle has the sort of silly story that is all too common from local news organizations these days: making broad claims based on a single anecdote, with no actual evidence to support the thesis. In this case, it's claiming that people "absorbed" by their devices were to blame for no one noticing a guy brandishing a gun on the SF Muni train a few weeks ago:

A man standing on a crowded Muni train pulls out a .45-caliber pistol.

He raises the gun, pointing it across the aisle, before tucking it back against his side. He draws it out several more times, once using the hand holding the gun to wipe his nose. Dozens of passengers stand and sit just feet away - but none reacts.

Their eyes, focused on smartphones and tablets, don't lift until the gunman fires a bullet into the back of a San Francisco State student getting off the train.

From there, the article just goes on basically a long rant about the evils of mobile devices and how no one looks at each other any more. To make this claim plausible, it quotes the District Attorney, who claims that this "speaks to a larger dilemma of the digital age." And then there's a professor who makes the same argument:

"When you used to go into a public place, you assumed everyone was in that place with you," said Jack Nasar, an Ohio State University professor in city and regional planning who specializes in environmental psychology. "What happens to public places when everybody is talking on a cell phone? Everyone is somewhere else.

"Someone can take a gun, hold it up, and nobody will notice it."

This seems pretty damn questionable. While I'm sure it's true that lots of people get absorbed by looking at their mobile devices, the fact that no one looked at the guy can't be blamed on mobile devices. Perhaps it's because I grew up in NY, but I learned from a very young age that you don't look at people on public transit. You just don't. It's rude and, if anything, it's more likely to provoke a dangerous situation. Over the years, I've ridden plenty of public transit systems around the world, and this is pretty typical -- and it was typical long before mobile devices came on the scene. In fact, it seems like mobile devices just helped give people something to do rather than stare off into random space.

So, yes, it seems shocking that no one noticed the guy with the gun until he shot and killed someone, but it's a pretty big leap to automatically blame everyone being on their mobile phones. It seems unlikely that everyone on the train was staring at a mobile device. It seems likely that some were just staring out the window as well. Will the DA and professor Nasar blame windows for destroying public places now too?

Filed Under: mobile phones, paying attention, public transit