While technically unconnected to each other, recent reports about the Secret Service and Immigration and Customs Enforcement playing fast and loose with rules regarding cellphone tracking and the FBI purchasing phone location data from commercial sources constitute an important wake-up call. They remind us that those handy mobile devices many people tote around are the most cost-effective surveillance system ever invented. We pay the bills for our own tracking beacons, delighted that in addition to tagging our whereabouts, they also let us check into social media and make the occasional voice call.
Fooling Your Phone Into Revealing Your Presence
"The United States Secret Service and U.S. Immigration and Customs Enforcement, Homeland Security Investigations (ICE HSI) did not always adhere to Federal statute and cellsite simulator (CSS) policies when using CSS during criminal investigations involving exigent circumstances," the Department of Homeland Security's Office of the Inspector General reported last month. "Separately, ICE HSI did not adhere to Department privacy policies and the applicable Federal privacy statute when using CSS."
The OIG report referred to the use of what is commonly called "stingray" technology—devices that simulate cellphone towers and trick phones within range into connecting and revealing their location. "When used to track a suspect's cell phone, they also gather information about the phones of countless bystanders who happen to be nearby," the ACLU warns about their use.
Because of their indiscriminate nature, stingrays are supposed to be used only with court authorization. That usually means a warrant, and the report found the agencies got a warrant when required. But in "exigent" circumstances requiring fast action, law enforcement is still supposed to get a lesser pen register order. Even under emergency circumstances involving risk of death or serious injury, applications for a pen register order are required within 48 hours of use, essentially authorizing surveillance after the fact. That doesn't always happen.
For a subset of investigations from 2020 to 2021, "the Secret Service did not obtain pen register court orders for [redacted] investigations using CSS under exigent circumstances, as required by policy and statute," noted the OIG. During the same period, for a redacted category of investigations, "ICE HSI did not obtain warrants and was unable to provide evidence it applied for or obtained pen register court orders."
Investigating agents from the agencies also failed to document "supervisory approval before CSS use and data deletion upon mission completion."
"The fact that government agencies are using these devices without the utmost consideration for the privacy and rights of individuals around them is alarming but not surprising," commented Matthew Guariglia, senior policy analyst for the Electronic Frontier Foundation (EFF). "The federal government, and in particular agencies like HSI and ICE, have a dubious and troubling relationship with overbroad collection of private data on individuals."
Your Whereabouts Are Available for the Right Price
And that brings us to the FBI's cellphone surveillance. This revelation might be a bit less dramatic, referring as it did to a (supposedly) past practice of determining where people have been rather than where they are now, but it was still eye-opening.
"To my knowledge, we do not currently purchase commercial database information that includes location data derived from internet advertising," FBI Director Christopher Wray responded to a question from Sen. Ron Wyden (D-OR) during a March 8 Senate Intelligence Committee hearing. "I understand that we previously, as in the past, purchased some such information for a specific national security pilot project. But that's not been active for some time." He then offered to provide more information in closed session.
"When we use so-called adtech location data it is through court-authorized process," Wray added.
Wray's "adtech" is software and tools used to target digital advertising campaigns. In order to personalize advertising, the apps we use on our mobile devices gather a lot of data on us, what we do, and where we've been that is tied to a unique ID.
"The IDs, called mobile advertising identifiers, allow companies to track people across the internet and on apps," Charlie Warzel and Stuart A. Thompson wrote for The New York Times in 2021. "They are supposed to be anonymous, and smartphone owners can reset them or disable them entirely. Our findings show the promise of anonymity is a farce. Several companies offer tools to allow anyone with data to match the IDs with other databases."
The tracking-beacon nature of our phones is so obvious and intrusive that the Supreme Court ruled in Carpenter v. United States (2018) that "the Government will generally need a warrant to access [cell-site location information]." But adtech gathers GPS data from commercial tools, not locations from cellphone companies, and is considered marketing data. That data is openly available for sale. Among the buyers are government agencies working around the Carpenter decision.
Wray said that, to his knowledge (nice hedge there), the FBI doesn't currently purchase adtech. But even if true, that's a policy decision, not a legally binding guarantee. Other agencies very definitely do purchase commercial cellphone location data, and the courts have yet to weigh in.
High-Tech Fishing Expedition
And, post-Carpenter, even the most precise phone company location data remains available with court approval. The courts are currently mulling multiple cases involving "geofence warrants" whereby law enforcement seeks data not on individuals, but on whoever was carrying a device in a designated area at a specified time. Think of high-tech fishing expeditions made possible by smart phones.
"We argue these warrants are unconstitutional 'general warrants' because they don't require police to show probable cause to believe any one device was somehow linked to the crime under investigation," EFF surveillance litigation director Jennifer Lynch wrote in January. "Instead, they target everyone in the area and then provide police with unlimited discretion to determine who to investigate further."
So, the next time you leave your home to do something you'd rather leave unobserved, give some thought to what's in your pockets. If their contents include your phone, you might as well be carrying a tracking beacon.
The post Federal Agencies Are Still Using Our Phones as Tracking Beacons appeared first on Reason.com.
