To find suspects, police quietly turn to Google
wral.com
wral.com
1. Google stores location history data for more of its mobile users than you might expect. The precision is greatest when GPS is on, but less precise data from cell towers and WiFi sources is used almost any time a Google app is being used on an Android or non-Android phone. There have been cases in the past where Google has recorded such information even when the user has explicitly turned off all location services, but Google says they have stopped this practice.
2. On multiple recent occasions, police in North Carolina have quietly been successful in obtaining search warrants that force Google to turn over these records. Rather than "standard" search warrants asking for the location of a particular suspect in a crime, these "reverse" or "area based" warrants ask for time and location data for all users who have entered a geographical area during a time of interest. The records returned are initially anonymous account numbers, and the police then make followup requests for identifying information of the subset of accounts that they think are of interest to the case.
3. This open-ended "drag net" approach scares some people. Typically, at least in the US, suspects are identified first, and then further information is gathered that confirms or removes the suspicion. The express fear seems to be that innocent people will be falsely accused due to coincidence, but there is also a more general fear that once mechanisms are in place that allow the police to have easy access to location tracking information, this information will end up being abused.
What do you mean by this?
I possibly wasn't clear enough. That's what I meant when I wrote "If you have all location services turned on". Location tracking is part of location services.
GDPR can't come soon enough...
The NSA’s surveillance dragnet is a very different situation because they are a government agency, but you could see the same exact phenomenon happened when the Snowden revelations came out.
“Do you really think the government cares enough to log all your phone calls? You must be paranoid.” became “Well, obviously the government does this. How could you not expect this?” in the blink of an eye.
I love these comments, you seem them all the time (Everytime this happens if you will). And they are phrased as though they are above questioning.
My main reason is to squash the annoying notifications about "heavy traffic in your area" at 5:00pm. Yeah, I would never have guessed...
Subject: You are using Google Location Sharing to share your real-time location.
Hi Jeff,
To protect your privacy, we would like to remind you that you are sharing your real-time location using Google Location Sharing with [wife] and [close friend and housemate].
If you didn't enable this or want to stop sharing your location at any time, please go to your Google Location Sharing settings.
Thanks,
Google Location Sharing Team
Is there by chance another one with location history or am I imagining things?
I'm sure I get it by email approx once per month.
GDPR enabled.
Anyway, the GSPR does not ban American-style surveillance in Europe. Most European countries have used the Snowden leaks as a blueprint to increase surveillance in almost every aspect, especially online and with many related obligations for Internet companies.
It’s possible (if unlikely) that after a militant based in Europe but geo-IP located elsewhere by accident notices something unsavoury and complaints, that companies implements an “Are you based within the EU?” toggle in account settings to avoid headaches.
For social services, I’m curious on how processes based on your friends’ will be implemented when your friends are partially in the EU and elsewhere. But I don’t expect this will be much harder than it currently is to circumvent, say, Netflix geo-blocks.
Hopefully it affects U.S. policy in the next decade or so.
P.S. I'm curious how you found my city. LinkedIn?
https://www.theguardian.com/technology/2018/mar/16/silicon-v...
'“When you first get to Facebook you are shocked at the level of transparency. You are trusted with a lot of stuff you don’t need access to,” said Evans, adding that during his induction he was warned not to look at ex-partners’ Facebook accounts.'
It’s probably obvious but our best bet is in voting for Bernie Sanders.
...or with the large number of ordinary citizens who would oppose them or be indifferent to them. People here tend to have their privacy/safety balance set quite a bit more toward the "privacy" side than do most people.
Where most people draw the line, I think, is when surveillance is looking into their homes. Being surveilled when they are out and about in public does not bother them much.
LinkedIn's new policy that goes into effect in May appears to grant GDPR-like permissions across all users, for instance, though it does specify that EEA countries may have additional rights under the law. I suspect the majority of companies will end up complying with GDPR globally.
There are additional laws that could protect citizens against overreach. But something like the GDPR alone would not do the trick.
This is especially dangerous given that there is already overreach in which data on the correlation of travel and behavior with crime, is being used to unlawfully detain people: https://www.npr.org/2017/12/05/568351544/teens-arrested-on-g... This data would only serve to multiply that problem. It's not an easy problem to solve.
The interesting question here is why law enforcement is going to Google instead of the cellular network providers directly? By definition, they're missing out on data from all non-Android phones.
I haven't read the original article since the website doesn't work without off-domain scripts running, but I assume that's why - they do have data for iOS users running Google apps, and that data is often higher resolution than cell tower triangulation. I'd also assume they're getting the cell information as well and correlating the two.
https://www.newyorker.com/news/news-desk/what-your-cell-phon...
"On May 28th, Lisa Marie Roberts, of Portland, Oregon, was released from prison after serving nine and a half years for a murder she didn’t commit. A key piece of overturned evidence was cell-phone records that allegedly put her at the scene."
If it's as accurate and straight forward as law enforcement tell us - how did _that_ happen?
I don't really need it most of the time, and I find the sense of privacy liberating.
You're looking for "Location History".
The government abusing data it collected on its citizens to silence dissenters, however, is something I've seen on a daily basis. And so, we set priorities.
GDPR was approved on 14 April 2016. Google appears to have been complying for a while, starting to remove search results year ago.
I have heard of people getting a copy of all the data Google stored, but I haven't heard of location deletion requests yet. Will be interesting.
Just be aware that deletion isn't instant though. From the TOS:
>We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.
It’s astonishing how quickly we forget. It’s astonishing and painful, to the memories of those whose pain and sacrifice was, in the end, wasted on us :(
Yes, it is. Quite a few people get misidentified based upon "bad paperwork" by the police.
If the police mistake the IP address and Google identifies it as me, I'm now at risk even though I did absolutely nothing.
Making the police engage in positive identification is simple safety.
But that's only the selfish motivation.
The wider reason is that mass surveillance can easily be used to silence dissent. And if you think that's far-fetched for the US, I invite you to read up on e.g. COINTELPRO.
Those laws/codes that you mention are there for a reason. We shouldn't be breaking them, is what we're told. If the whole thing was built on the predicate that only a fraction of people would be charged with them, what sort of criteria do you think those lawmakers had in mind as to when to apply that charge? Well, silencing dissent, for one.
But more to the point, either they're valid crimes and we need to do everything that is reasonable and cost-effective to enforce them. Or, we don't really consider them a crime, but we work on some funky as yet-undefined honor system about when to apply those laws. I.e. Let's use them to stick it to the bad-guy™. Usually, it's at the whim of whoever is deciding on whether to charge someone.
You are absolutely right that government can use these laws against you if they dislike you. But they can do that with a whole host of other things that we consider pretty benign. Being a white minority and a foreigner in an majority black country, I am constantly singled-out and harassed and at the whims of whatever government official I interact with. Usually police, but desk-clerks and the like also have their fair share of it. Government, and their agents can ruin your life on whim, even with existing non-surveillance-like laws.
We need to get past the point where vagueness and subjective criteria are used to enforce whatever laws we deem as a society to want to have. The vagueness and subjectiveness is the problem, not the laws.
And mass surveillance can be used to silence on a large scale - that's the whole point of objecting to it. It's not about you. Or me. It's about the effect on society as a whole
How long until these records are available for subpoena, e.g. in a divorce case? (Maybe -- hopefully! -- not in area sweeps, but nonetheless, where was the other party and who was in proximity. As I'm writing this, well, maybe they will ask for all connections in proximity, that list then to be whittled down to a list of candidates (per the police's approach in the OP's story)).
When are police going to start sweeping such data up en masse, looking for e.g. parole violations?
When will every "free association" be a tracked association?
I see nothing preventing this information being sought in U.S. discovery right now--at least in Federal litigation[0]. That isn't to say that the subpoena won't be squashed by a court for one of the traditional rationales under FRCP 26(b).[1]
>When are police going to start sweeping such data up en masse, looking for e.g. parole violations?
Arguably runs afoul of the particularity requirement of the fourth amendment, although I do not pretend to be an expert on criminal law. That said, I understand the fourth amendment to be a low bar these days.
> When will every "free association" be a tracked association?
Rhetorical question?
[0] Your specific example, divorces, are state law in the US. I don't do that, and the relevant laws / cases can change on a state-by-state basis.
Yes, the last part could be considered rhetorical. Except, I think that is the very real direction some -- including especially some already in authority, in the U.S. as well as around the world -- want to take things.
On the other hand, maybe my question is rhetorical, in that the tracking is already in place.
But this is taking it to another level. Here, location and time are the only identifiers. Once you've identified someone who was at the location of the crime when it was committed, they were either a perpetrator or a witness. Or maybe neither, because they weren't close enough in space and time.
But anyway, what happens next? Police hope to get a confession? Maybe some physical evidence. Or witnesses. But then, people often lie. And there's less opportunity for an alibi, except maybe a friend who says he was there with you. But his phone had better agree with yours.
And really, it's hard to imagine that someone doing serious crime would be carrying a smartphone. At least, one that's not turned off, and in a Faraday bag. But then, some criminals are just plain stupid, I guess.
Police can lie with impunity when interrogating and it is all legal and protected mostly. They can get innocent people to plead guilty to all kind of crimes the didn't commit simply by threatening them.
The privacy of the bystanders is not significantly reduced if and only if the police will use the specific datadump for the purpose of solving the crime for which the warant has been issued - as opposed to building a massive cross-referenced database from multiple such incidents. I am concerned that a few warrants like 'all information on everybody who was at the Superbowl' would quickly download massive amounts of data from Google to the police.
I think regulation should be enacted that balances the social interest with the private interest, for example, Google could be issued a specific warrant of the type "data on all individuals that were in location X1,T1 and also in X2,T2", and Google should answer only when the query is sufficiently specific to return only a handful of results.
Which isn't to say that I think we should allow limitless collection but rather that, even while justifying it using CCTVs, you're still treating them differently. I'd wager that's because it is different.
Anyway, you might be interested in Carpenter v United States, which is testing the third-party doctrine in front of the Supreme Court and will be decided soon. https://en.wikipedia.org/wiki/Carpenter_v._United_States
Perhaps I'm wrong, but I can't imagine them managing the overwhelming temptations to quietly abuse the data, especially as time goes on.
Edit: I realize this is a crude analogy that glosses over a lot of important details, but it gets at the heart of my intuition on the matter. The lack of restraints found in the child-candy system seems to mirror very well the weakness of restraints found in the dynamics between government apparatuses and fancy tools.
For many tools, this is fine. But I'm worried about the long tail risks and externalities of large-scale privacy destroying tools.
I don't think this is exclusively an issue with government organizations. However, in America they are the only organization with the ability to forcefully restrict the actions of individuals and groups. So extreme vigilance is required to balance out this immense power. If a random company overuses a fancy tool, the potential damages are more limited.
I am wondering if the solution is to have an independent service. One that would sit as a middleman between police and technology companies such as Google. Their mandate would be to provide the minimum amount of data required for an investigation (the example used in the article is a good one, where anonymous data for a particular location at a particular time-frame is requested and used to narrow down the search and then get more information on a subset of that data). They could be required to keep logs of what is being requested and what is being provided and could be audited at intervals by, say, the EFF. Obviously this is only a rough sketch of the idea, it would need fleshing out more completely.
Individual notions of fundamental rights aside, very recent cases have addressed protection given to location information: https://www.supremecourt.gov/opinions/11pdf/10-1259.pdf
A very, very related case to the article above is currently pending a decision by the Supreme Court: https://www.oyez.org/cases/2017/16-402
I wonder how Google show that on their transparency report? Hopefully "Accounts searched: 1.5 Billion"
No, at best this only shows that your google linked device (presumably a phone) did not have location information for that area at the specific time.
Alternatively it suggests the device could have been switched off/disconnected from the network to hide your presence - making you really a suspect of interest if your name comes into the investigation for some reason.
Dragnet approaches to law enforcement are inherently wrong. They unreasonably cast suspicion on everyone without any good basis and reverse the accepted safeguard that your guilt requires to be proven, and replace it with the idea that you require to prove your innocence.
That's really interesting. If I'm understanding you correctly, people who routinely switch off their location services, could potentially end up as suspects in crimes if they, for instance, live in the apartment across the hall from the victim or something.
So keeping location services on let's the police keep tabs on you, potentially making you a suspect in some crime in the future. Alternatively, turning it off potentially turns you into a suspect of interest in some potential crime in the future.
Sounds like you agree entirely with the poster's final comment :
"They unreasonably cast suspicion on everyone without any good basis and reverse the accepted safeguard that your guilt requires to be proven, and replace it with the idea that you require to prove your innocence."
For example, Sparkfun received a subpoena[0] once and they ended up having to turn over customer details of anyone from Georgia who purchased a particular Sparkfun product that was used in some crime.
Another example, we've all seen movies or heard where someone sees a vehicle that flees the scene of the crime and they knew the make and color or the first few digits of the plate but not enough to identify the vehicle so they go and pull all DMV records matching the vague description and use those leads to narrow things down from there.
This Google thing is really the same thing in this case they have a vague description of a person and a narrow time period and area in which to search. They also are getting a warrant. Seems like an application of an old technique to modern technology.
Everyone in an "area" is not necessarily a narrow scope.
The dragnet is every device, not just those matching a partial description of a suspect. For it to compare with your car example, the police would need to have a description of a suspect using an Android Galaxy S4 (or whatever) and then ask only for Galaxy S4 devices in the area.
And no one quite knows why, other than "because we can". There is Google Maps, but when I'm not using it, when exactly is this orwellian infrastructure to my benefit and not exclusively Googles?
While a true statement, it’s unfortunate how broad of a license it ultimately provides.
Did I make mistakes in the above paragraph? Probably. But you know what, that's Google's fault, because it sure isn't clear what they aren't and are doing, who can and can't use it, and what I can can't opt out of.
That's the really frustrating part, here. It's purposely obfuscated and changing - similar to Facebook's privacy settings - to keep you on your toes even if you are in the tiny percentage of the population that actually cares. Most won't until something panicky / headliney happens to make them care. I'm kind of glad the EU is making life tough for American tech companies with regards to privacy (even though I work for American tech companies).
As mentioned in the article, Google was previously caught tracking people even when they had location, data, and Wi-Fi turned off. We just have to take their word now that they don't do it anymore, and the word of a big profit driven corporation that has been implicated in PRISM and previously tracked people isn't worth too much.
Furthermore, even if Google doesn't track you the cell phone companies still know which tower your cell phone was connected to, so they know your location within three miles at all times. It's not as precise as GPS info, but the police could still ask the cell phone companies to give them a list of phone accounts that were visible to a specific set of cell phone towers at a particular set of times.
1. WeChat. This is made completely useless without internet connectivity.
2. Kindle. This is totally unaffected by internet connectivity.
3. Pleco (a Chinese-English dictionary). The only internet-using feature here is the addon store. Again, totally unaffected.
4. Reading my email. Impossible without the internet connection.
5. OsmAnd. Requires the GPS, but doesn't need or use the internet connection.
6. The camera. Again, no need or use for the internet connection.
What's the point, indeed?
You can carry a phone inside a Faraday cage, or a phone without those radios. I think this remains consistent with my comment.
[Citation Needed]
While your location can absolutely still be tracked (via WiFi, Cell Towers, etc), disabling GPS significantly reduces the accuracy of this tracking, and disabling location history makes it even more difficult to freely track you.
While it's certainly possible Google maintains location history even after you opt out, doing so would likely be illegal, would possibly invalidate any data obtained from a warrant, and would unquestionably be a PR fiasco for Google when it got out.
As far as I'm aware, there's no evidence that GPS continues to function after turning off the software kill switch.
etc covers too many to list though... because everyone is doing it (even yc companies)
They're themselves creating the incentive to do that, just as when they got into the content and content licensing game, they ended up creating the most aggressive content censorship system on the (free) internet, beyond even what the laws require. It's no longer a matter of "choosing to do the right thing". The (bad) incentives are already in place. Now Google just reacts to the incentives it created.
We're also supposed to "just trust them" that their secret AI Ethical Board, which can be replaced at any moment, also in secret, will do the right thing when things will go bad with its AI. They've already created the incentive to cheat by keeping that board secret.
They sold their stake in Boston Dynamics
https://www.bloomberg.com/news/articles/2016-03-17/google-is...
Ah yes, very "natural"
And they're carefully balancing civil rights with public safety.
and "carefully balancing"
Bureaucrats and their weasel words.
Identifying those close to a crime is and always has been standard and reasonable police procedure.
The reasonableness of a subsequent search based on this location information is context dependent.
If this is going through a warrant process, and it's geofenced around a specific crime they're investigating, it's hard to feel too worried about it. The worst case scenario I can see is that it makes it easy to generate false hypotheses and put innocent people under suspicion, but then so can canvassing the neighborhood and trawling all the nearby CCTV.
CCTV and GPS "fencing" would be comparable if Google were to issue statements clarifying that your location is being tracked and recorded, and may be surrendered to the police without your knowledge.
Also, given that Google don't make it obvious when they're storing information in the phone or on their servers, information that intuitively feels like it's inside the phone should be protected by the 4th amendment's prohibitions on illegal searches. That's if the phone is owned by the suspect. If the phone is owned by the victim or anyone willing to give consent to search, I have no problem with police using it.
The due process required by the 4th amendment is performed when the court issues a warrant, which they did here. If Google were providing this without a warrant, or in response to an NSL or the feds were using the 3rd-party doctrine to argue that these searches weren't protected by the 4th amendment then I'd be worried.
> The due process required by the 4th amendment is performed when the court issues a warrant, which they did here
The warrant was to search Google's servers, not the potential suspects' phones. What I'm saying is that I believe this data is logically part of the phone despite the fact that it resides on Google's servers because of the way that Google chose to implement their services. If they want to get a warrant for a specific person's phone because they believe the location information in the phone will prove that the suspect was in the area, that's different. But fishing for suspects using location data feels wrong to me. For one, it is almost guaranteed to also cover innocent people. Unless it's a remote area where only the perpetrator and victim were present, someone innocent will get unnecessarily dragged into the investigation.
Well, neither do the sorts of warrant mentioned in the article. They don't even get phone numbers, just arbitrary phone IDs and where they were located to be inside the region.
If they were scooping up everyone's digital fingerprints en masse without probable cause and without a warrant, then that's something else entirely, but that didn't happen here.
"It's just metadata!"
They are requesting this from Google, not you, so your 4th amendment rights don't matter.
I don't necessarily agree with that ruling, but as far as I know that's the current state of things.
There's actually a court case at SCOTUS that may more closely define what is and isn't covered by the 3rd party doctrine when it comes to phones.
http://www.scotusblog.com/2017/08/symposium-will-fourth-amen...
Ownership of a gps enabled tracking device? No chance that is ever cheap enough to be considered required to own as evidence against incarceration.
I'm still in the process of getting off google mail and switching to Proton. It takes time to go thru all my google emails and clean them up. Yes I know deleting them won't change a thing BUT at least I consent to deleting them on my end, versus merely abandoning my mailbox altogether.
I know Google has capacity to keep all emails forever, but whether they do so or delete them after X amount of years, I don't know.
The GDPR law in europe requires them to do this for european citizens.
It's clear that they don't trust their own police. That's perhaps the real problem. If they could be made trustworthy like in many other countries, people would probably be happy to have murders solved through video footage, cellphone locations, etc. It amazes me that even one person on here thinks this is a bad idea. Real killers would have got away otherwise. This isn't some wild NSA anti-terrorism dragnet, it's just normal police work collecting normal evidence specific to the crime.
Asset forfeiture, crooked cops, shoot first ask questions later, a strong union which protects their own, and their ability to spy on their personal rivals through NSA/FBI tools makes us a paranoid bunch.
The last part.. NYPD mis-used tools to track former lovers[1] and there was no reprocussion. How can we feel safe?
[1]https://nypost.com/2013/11/08/jealous-cop-admits-to-hacking-...
Not to mention historical corruption on a grand scale.