{"id":21142,"date":"2023-02-02T04:30:14","date_gmt":"2023-02-02T12:30:14","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/02\/02\/news-14875\/"},"modified":"2023-02-02T04:30:14","modified_gmt":"2023-02-02T12:30:14","slug":"news-14875","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/02\/02\/news-14875\/","title":{"rendered":"ACLU, public defenders push back against Google giving police your mobile data"},"content":{"rendered":"

<\/p>\n

The ACLU and eight federal public defenders are asking the Fourth Circuit Court of Appeals to exclude mobile device location data obtained from Google via a so-called geofence warrant that helped law enforcement catch a bank robbery suspect.<\/p>\n

The first geofence civil rights case to reach a federal court of appeals raises serious Fourth Amendment concerns against unreasonable search and seizure related to the location and personal information of mobile device users.<\/p>\n

Geofence warrants have primarily been issued for Google to hand over data about every cell phone or other mobile device within a specific geographical region and timeframe. The problem: location data on every person carrying a mobile device in that area is scooped up in a wide net and their data is then handed over en masse to law enforcement.<\/p>\n

\u201cThese warrants are patently unconstitutional,\u201d said Tom McBrien, a law fellow with the nonprofit Electronic Privacy Information Center (EPIC) in Washington DC. \u201cThey look through everyone\u2019s location history within that geographical area to see where they were at the time.\u201d<\/p>\n

Geofence warrants violate the Fourth Amendment of the US Constitution on several fronts, McBrien argued. First, the amendment requires that evidentiary warrants meet the \u201cparticularity requirement,\u201d meaning police must be specific about what and who they\u2019re seeking to find with the data. The warrants can\u2019t turn into \u201cfishing expeditions,\u201d McBrien said.<\/p>\n

Secondly, probable cause requires law enforcement to link a specific person or persons to a crime. Only in that case does the law allow the invasion of privacy that comes with geofence data access.<\/p>\n

\u201cGoogle has a rich database of user information,\u201d McBrien said. \u201cYou either have a Google phone or you use a Google service. Google has made it very hard to opt out of location tracking. Even after turning off the specific feature on your mobile phone, Google can still track you through another [service or app]\u2026such as Google Maps.\u201d<\/p>\n

Additionally, Schneier said, it\u2019s not just Google that has access to geolocation via a cell phone\u2019s ping off a cellular tower. Cellular network providers and cell phone companies also have that data.<\/p>\n

\u201cThey\u2019re the ones collecting the data and you can\u2019t opt out,\u201d Schneier said, “because that\u2019s how cell phones work.\u201d<\/p>\n

McBrien agreed cell phone companies and other network services can track users, but he has yet to see a geofence warrant issued for any company other than Google because it simply has to most data to farm.<\/p>\n

\u201cApple may know where users are, but there are also a lot of Android users not using Apple\u00a0iPhones \u2014 but someone with an iPhone or an Android phone may be using Google Maps,\u201d McBrien said.<\/p>\n

The problem with geofence warrants goes beyond gaining access to copious amounts of mobile user location data that may, or may not, have anything to do with a crime.\u00a0Thousands of innocent individuals each year are effectively turned into suspects in criminal investigations through the use of the warrants, according to a Harvard Law Review post<\/a>.<\/p>\n

“While traditional court orders permit searches related to known suspects, geofence warrants are issued specifically because a suspect cannot be identified,” the Harvard Law Review noted.<\/p>\n

The use of geofence warrants has been snowballing over the past seven years. Since the first one was served on Google in 2016, the number of warrants has increased more than 1,000% every year, according to EPIC.<\/p>\n

The number of requests from US authorities for user data from Google has grown dramatically over the past few years.<\/p>\n

Google received 982 geofence warrants in 2018, 8,396 a year later, and 11,554 in 2020, according to the latest data released by the company. The overwhelming majority of the warrants were issued by courts to state and local law enforcement. Geofence warrants issued to federal authorities amounted to just 4% of those served on Google.<\/p>\n

In 2021, Google revealed<\/a> that one-quarter of all warrants it receives from US \u00a0authorities \u2014 both state and federal \u2014 involved geofence requests.<\/p>\n

\u201cIt\u2019s obvious why these warrants are useful. They have the potential to uncover more suspects,\u201d McBrien said. \u201cI can understand why the courts feel hesitant at first about removing this powerful tool from police.\u201d<\/p>\n

Bruce Schneier, a security consultant with Counterpane Systems, said that in addition to possible government overreach, there\u2019s no way of knowing whether law enforcement will use the location data dump for other purposes.<\/p>\n

\u201cThe thing about abuses in these instances is they\u2019re hidden,” Schneier said. “If there\u2019s an abuse, you\u2019re not going to know because of parallel construction, which is the way data obtained illegally is washed and not used in court, but data obtained from that data is used.”<\/p>\n

For example, the National Security Agency (NSA) might obtain a geofence warrant specific to a suspected criminal, and then pass all of the data to the FBI to let the agency know something suspicious might be happening at a location.<\/p>\n

\u201cI\u2019m sure it happens a lot when the NSA passes the FBI data,\u201d Schneier said. \u201cThe NSA tells the FBI, ‘This thing is happening on a street corner,’ and the FBI just happens to have an officer there, and the NSA involvement is never mentioned. And, of course, if the FBI has this kind of data, they\u2019re likely to use it for whatever they [want].\u201d<\/p>\n

Last Friday, the ACLU and public defenders released a friend-of-the-court brief<\/a> requesting mobile device location data obtained from Google be excluded from evidence, while noting that geolocation warrants are becoming increasingly common.<\/p>\n

Globally, requests for user information from Google has also grown tremendously in recent years.<\/p>\n

\u201cThey raise serious questions under the Fourth Amendment because they are typically issued without police demonstrating reason to believe all the people who own those devices were involved in any crime,\u201d the\u00a0ACLU said in a statement<\/a>.<\/p>\n

The civil rights case in question is United States v. Chatrie<\/a>. Okello Chatrie, 27, was convicted and sentenced\u00a0to 12 years in prison<\/a>\u00a0using Google Sensorvault data obtained by Virginia law enforcement officials via a geofence warrant.\u00a0Sensorvault<\/a> is a Google database that contains records of users’ historical geolocation information.<\/p>\n

The appeal came after a federal judge in Virginia held that the geofence warrant in Chatrie\u2019s case was overbroad and lacked probable cause for much of the data police obtained. The warrant sought information about all Google device or app users who were estimated to be within a 17.5-acre area surrounding the location of a bank robbery in Virginia.<\/p>\n

\u201cIt\u2019s important to note that Google is caught in the middle of this issue,\u201d McBrien said. \u201cWe\u2019ve seen examples of Google pushing back on these warrants. Google is saying these look really overly broad \u2014 ‘You\u2019re capturing multiple city blocks, including churches, schools and apartments’ \u2014 and Google has said this is not passing the smell test.\u201d<\/p>\n

Last week, Google in a blog post<\/a>\u00a0explained how it hopes to better ensure user privacy in the face of thousands of geofence warrants being served on it every year.<\/p>\n

First, the tech company said will continue to advocate for an update to laws such as the\u00a0US Electronic Communications Privacy Act<\/a>\u00a0to mirror the same protections that apply to citizens\u2019 personal documents.<\/p>\n

Google also said when government agencies request personal information on users \u2014such as what a person provides when they sign up for a Google Account or the contents of an email \u2014 its policy requires several things:<\/p>\n

Google also said it plans to work harder to tell users about warrant requests and has\u00a0created a new section<\/a>\u00a0to its \u201cTransparency Report\u201d to answer questions users may have.<\/p>\n

In the amicus brief, the ACLU and public defenders argued that geofence warrants can incidentally reveal \u201ca wealth of information about the confidential associations of individuals swept up in their net, from a meeting between a journalist and a source to attendance at a church.\u201d<\/p>\n

In its statement, the ACLU said law enforcement has seized on the opportunity presented by this \u201cinformational stockpile, crafting geofence warrants that seek location data for every user\u00a0within a particular area.”<\/p>\n

There is a relative dearth of case law addressing geofence warrants, according to EPIC’s McBrien. Currently, law enforcement agencies are only held in check by the courts, and they push the envelope whenever they can, he said.<\/p>\n

\u201cI\u2019m currently aware of only seven federal cases that have come out [of geofence warrants]. State level cases are harder to track. It\u2019s a new issue,\u201d McBrien said. \u201cThere are more coming up every year. There will likely be a lot of case law coming up on this because the use of these warrants exploding.\u201d<\/p>\n

Schneier is not as confident the courts will address the problem quickly and said it\u2019s up to citizens to demand that lawmakers use legislation to limit the reach of geofence warrants. And citizens need to push Congress to address the issue.<\/p>\n

\u201cThe laws have to be changed,\u201d Schneier said. \u201cThere\u2019s no magic thing you can do on your phone to protect it. These are systemic problems that need systemic solutions. So, make this a political issue.\u201d<\/p>\n

McBrien believes the courts will eventually catch up with the technology and eventually set limits on the power of companies to collect and distribute geofence data to law enforcement. In the meantime, he agreed with Schneier \u2014 a two-pronged approach using both laws and the courts is the best approach to ensure constitutional rights to privacy are upheld.<\/p>\n

For example, the New York State legislature is currently considering the\u00a0Reverse Location Search Prohibition Act<\/a>, which would prohibit the search, with or without a warrant, of geolocation and keyword data of a group of people who are under no individual suspicion of having committed a crime.<\/p>\n

\u201cPart of this is society needs to become aware of the problem,\u201d McBrien said.<\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

\n
\n

The ACLU and eight federal public defenders are asking the Fourth Circuit Court of Appeals to exclude mobile device location data obtained from Google via a so-called geofence warrant that helped law enforcement catch a bank robbery suspect.<\/p>\n

The first geofence civil rights case to reach a federal court of appeals raises serious Fourth Amendment concerns against unreasonable search and seizure related to the location and personal information of mobile device users.<\/p>\n

Geofence warrants have primarily been issued for Google to hand over data about every cell phone or other mobile device within a specific geographical region and timeframe. The problem: location data on every person carrying a mobile device in that area is scooped up in a wide net and their data is then handed over en masse to law enforcement.<\/p>\n

To read this article in full, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[11063,11070,10554,5897,714,24580,11094,28499],"class_list":["post-21142","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-data-privacy","tag-emerging-technology","tag-mobile","tag-privacy","tag-security","tag-small-and-medium-business","tag-smartphones","tag-telecommunications-industry"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=21142"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21142\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=21142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=21142"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=21142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}