Virginia Police Have Been Stockpiling Private Phone Records
wired.com
wired.com
I highly recommend reading this investigation by a redditor into Fusion centers:
https://pay.reddit.com/r/technology/comments/1h3pc2/how_poli...
http://www.dhs.gov/fusion-center-locations-and-contact-infor...
http://www.michigan.gov/documents/cybersecurity/MichiganCybe...
There's a lot of interesting things that go on in the big (and little) cities in the country, but it's incredibly difficult for individual agencies to know what's going on in any of the others, except what they read in the newspaper. Using DHS as a service bus, they can better understand trends and collaborate on actions to deter or disable larger criminal networks.
Yes, Homeland Security gets easier access to local police intelligence and stats as well, but DHS and FBI I think have jurisdiction to get that anyways.
The point of these, though, is ultimately providing better information to police agencies so they can make better-informed decisions.
I for one am completely fine with law enforcement agencies sharing evidence that they have lawfully obtained (and they do this routinely with, e.g., the NCIS fingerprint database). That law enforcement agencies around the country do this with other information, including phone records, in so-called "fusion centers" was, I thought, already widely known. Is this somehow different?
Of course, here, there is good reason to be concerned about the way that many of the records have been obtained, and certainly this revelation provides further illustration of the unsettling ways that law enforcement can use phone records. Accordingly, it provides further reason to scrutinize the original collection of those records. But is there reason to think that this sharing is illegal in itself?
However, in most american states, "obtained legally" != "legal to archive" != "legal to look at whenever you want" != "legal to share" != "legal to use for any purpose other than that which it was originally obtained for".
Which means, while the gathering of the data may have been done legally, the archival and preservation of the data beyond their original purpose may be itself illegal, let alone sharing it, looking at it for reasons unrelated to the original cause, and using it for other purposes.
Edit: After a bit of Googling, it looks like this may be OK under Virginia Law. In short, it appears that the governing law is the Government Data Collection and Dissemination Practices Act, which provides an exception to retention and sharing restrictions for "criminal intelligence information." Here is a somewhat off-topic but informative opinion from the Virginia AG about retention and sharing of license plate reader information. http://www.vachiefs.org/images/uploads/docs/AG_Opinion_LPR.p...
(On the topic of "passive", always-on License Plate Reader data collection that is archived without looking at it "in case it's useful later"):
> On these facts I conclude that the need for such data has not been "clearly established in advance," so as to conform to the applicable principle of information practice. [12] Its future value to any investigation of criminal activity is wholly speculative. Therefore, with no exemption applicable to it, the collection of LPR data in the passive manner does not comport with the Data Act's strictures and prohibitions, and may not lawfully be done. [13]
To absorb this back into the whole phone records thing, here's the keypoints I gather from that:
1. Need to target specific data that is as constrained as possible given prior knowledge. E.g. If you already know someone spoke on the phone about a crime at X date and never spoke of it at any other date, you are only allowed to obtain and use the records of that date.
2. Need to be able to show reasonable belief _before collection_ that the collected data will be useful for an investigation and/or for intelligence on criminal activity. Knowing that a criminal uses a phone is not sufficient cause to collect phone records - it must be demonstrable before collection that those particular phone records might contain information useful for identifying criminal activity or for ongoing investigations.
3. Data that is mass-collected for purposes of finding a specific information (e.g. searching for a license plate by processing every car that passes through X intersection) may be kept and shared only until the target information is located and the objectives met.
4. Every data collection must have a specific purpose and clear boundaries. Collecting records "to find people who issue death threats"? NOT OKAY. Collecting records "to find this particular issuance of a death threat"? OKAY. In other, techier words, there must be a deliverable. If the goal of a data collection is open-ended, or could take decades, then you must have a specific warrant associated to that data collection, and the data must be discarded once the warrant expires and/or the investigation concludes.
This is pretty much my reading of it given cursory scanning of an abstract of the GDCDPA, prior knowledge on legal interpretations for "criminal intelligence information" (an extremely important phrase), and the A.G. advisory linked in parent.
Notice, if you read correctly, that I didn't make any particular judgment as to whether or not I think it's legal or not, or whether I think it should be legal or not.
My intent was simply in pointing out that the commenter's assumptions and logical deductions were unsound as far as a judge looking at a court case might be concerned.
So you seem to be claiming that these are distinct legal categories which affect the admissibility of evidence at trial. I don't think this is true; as far as I am aware, prosecutors and police can freely share information collected in different cases as long as that evidence is all disclosed to the defendant prior to trial (and early enough for the defense to prepare or seek a continuance etc.).
For example, it's legal (per the Supreme Court) to take DNA swabs from arrestees without a warrant even if no charges are brought, and all such DNA evidence is by default loaded into a national database known as CODIS. Your DNA data, according to a majority of the Supreme Court can legally be archived, looked at whenever law enforcement wants, shared, and used for other purposes than that which it was originally obtained for.
http://www.hamptoninstitution.org/dnadatabases.html
So again I ask, do you have something to back up your claim about things being different in 'most american states' or were you just saying you didn't think it worked that way?
Ah. There's the hiccup. It wasn't my intent to be communicating anything about admissibility of evidence. Archiving, sharing, obtaining, perusing, using for original purpose and using for a tertiary purposes are all different actions, and which of these actions were taken and in what contexts would be evaluated differently by a judge ruling on a "borderline" case that is up to legal interpretation.
The Supreme Court, to reuse your example, has effectively ruled that DNA collection is, upon arrest, legal for use in all above activities, if I understand correctly. To throw in what I did think, no, I didn't know it worked that way, and I'm pretty happy no government database currently has my DNA data (time to look up relevant Canadian laws to see if this is true here as well).
I don't have anything particularly solid to back up the claim that most states would not automatically grant all the actions above as "legal" if any given one of them is legal in a given situation (like the Supreme Court apparently did for DNA swabs). It just seemed particularly likely given my priors and whatever equivalent situations or contexts I could remember (I've read two US state codes of law (Ohio and Texas), and I'd estimate 20% of USA federal laws, that are available online on their respective public websites).
EDIT: To clarify first paragraph: I'm talking here mostly about situations such as someone suing a police force or suing the state over privacy breach or somesuch, not about whether a judge would use what police did with phone records and whether they shared it in a Fusion to dismiss a case about child pornography, for instance. That's a whole other (and more complicated) ball of yarn, IMO.
* Do the police have a right, legal or ethical, to read these emails?
* Do they have a right to share these emails?
* Should these emails be purged from police records after the case has gone to trial?
Hint: It doesn't.
Well, for starters, let's say you've got a robbery ring of people snatching iPhones in public places. Police track them, raid their meeting point, and proclaim this glorious bust with 67 arrests related to the nefarious criminal snatcher ring. What happens to the phones present onsite during the raid? Seized.
So they now have 300 seized smartphones, acquired legally. What do you think they do with them? Open 'em up, check the data, put it on the Fusion, of course! I mean, it's intelligence on the kinds of data criminals keep with them, so it's fair game, right? (Hint: Nope. But some police officers really do think this way.)
What's more... maybe some of these phones were already "cleaned out" by the snatcher ring, and maybe some weren't. Time for a subpoena to the phone carriers to know which phones belonged to whom! And, well, while we're at it, it might be useful to know if any of these phones actually belonged to some of the snatchers themselves, maybe it'll lead us to their contacts and to more of their affiliates. This is still criminal activity intelligence, right? So let's also get all the phone records and contacts and calling history for all the previous numbers and owners of all of these phones.
See how quickly this stuff escalates? And how easy it is for any officer or investigator to get carried away and justify it to anyone who asks?
(Note: I'm not saying this happened. It's a thought experiment.)
"In the case of the Virginia database, it’s unclear whether content from seized cellphones—such as text messages— is included in the database or if it just contains so-called metadata describing the phone numbers called, the calls received and their date and duration."
This is what I mean when I say that the Wired article does not have enough information for me to know whether anything shady is going on or not.
Uhm. This already includes phone numbers called, calls received, dates, durations. Also, it's well-known among even amateurs and armchair intelligence analysts that "metadata" is usually more than sufficient to obtain a complete profile of an individual's private life, and it's been confirmed at least once by US Mil-related interests that they have killed foreign terrorist suspects based only on conclusions drawn from metadata.
So even if it "just contains so-called metadata", that's probably still enough data to know the exact time you use the toilet in the morning, and for how long. Literally. (ref: Dozens of recent papers on metadata profiling)
They can look at any of and use any of it in a court. The only exception would be if the police go the hacker and ask him to do it.
If only someone like you were around 200+ years ago to tell Washington, Jefferson, and Adams that they should accept new reality and adapt to the British seizing our ships, blockading our ports, burning our towns, and spilling our blood.
One can also argue that Washington et al. did accept the reality and thus didn't insist on some new laws/rules restricting British Crown power in the colonies.
A lot of things around us are out of our control, so we have to adapt. Let's be honest, the political system is not within our control. Very, very little political change will come out of our complaints. Instead of repeatedly trying and failing to bring about meaningful change, we should adapt -- because that is the reasonable thing to do. We can't change the government's behavior, so let's change ours; something has to give.
"The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man." --George Bernard Shaw
What is not fine is:
1) encouraging the police to do illegal mass surveillance of citizens, too, with Stingrays and other methods
2) use information obtained in an illegal way (such as NSA spying on Americans) to do parallel construction by telling cops exactly who to stop at check points because they already know through illegal spying that he committed a crime, and then using that in Court, and saying they find out about his crime at a regular traffic stop.
Do some research on how the problems of data siloing and sharing are being solved and it should be obvious why this is bad.
If you're too lazy: https://firstlook.org/theintercept/2014/07/23/blacklisted/
"We believe that widespread and longstanding deficiencies in the FBI's operations and Counterterrorism Program caused the problems we described in this report," Fine's investigators wrote, including a shoddy analytical program, problems sharing intelligence information and "the lack of priority given to counterterrorism investigations by the FBI before September 11."
...seems like there could be some bias with that source.