Deeplinks

At long last, the U.S. Department of Justice (DOJ) has announced a slew of much-needed policy changes regarding the use of cell-site simulators. Most importantly, starting today all federal law enforcement agencies—and all state and local agencies working with the federal government—will be required to obtain a search warrant supported by probable cause before they are allowed to use cell-site simulators. EFF welcomes these policy changes as long overdue.

Colloquially known as “Stingrays” after Harris Corporation’s brand name for a common model, cell-site simulators masquerade as legitimate cell phone towers, tricking phones nearby into connecting to them. This allows agents to learn the unique identifying number for each phone in the area of the device and to track a phone’s location in real time. But Stingrays can get a lot more than just identifying numbers and location data—by virtue of the way they work, all mobile traffic (voice, data, and text) from every phone in the area could be routed through the Stingray, giving the operator the option to do anything from recording entire calls and texts, to selectively denying service to particular phones.

Until recently, law enforcement’s use of Stingrays has been shrouded in an inexplicable and indefensible level of secrecy. At the behest of the FBI, state law enforcement agencies have been bound by non-disclosure agreements intended to shield from public scrutiny all details about the technical capabilities and even model numbers of the devices. Law enforcement has gone to extreme lengths to protect even the most basic information about them, even dropping charges rather than answering judges’ questions about them. Although today’s policy changes don’t directly affect the non-disclosure agreements already in place, the tone of the announcement, along with a clarification from May, gives us hope that more transparency is on the way.

What today’s changes do:

• Federal law enforcement agents will be required to obtain a search warrant supported by probable cause prior to using a cell-site simulator in a law enforcement context. A search warrant requires a showing by the agent, under oath, that meets one of the highest standards in federal law. This incredibly important change is precisely what EFF has been asking for.
• Agents will only be allowed to use Stingrays in “pen register” mode, meaning the devices will collect only the basic location of the phone and the numbers of incoming and outgoing calls and texts. Agents will not be allowed to collect the content of your communications -- like your emails or text messages -- even if the cell-site simulator is capable of such collection.
• Finally, Agencies must delete data on users not targeted in either 24 hours or 30 days, depending on context.

What today’s changes don’t do:

• The new policy isn’t law and doesn’t provide any remedy to people whose data is swept up by Stingrays operated without a warrant. Indeed, it won’t even act to keep evidence collected in violation of the policy out of court (this is known as suppression).
• The policy doesn’t apply to the use of Stingrays outside of the criminal investigation context. For instance, when federal agents use cell-site simulators for “national security” purposes, they won’t be required to obtain a warrant by the terms of this policy.
• There are two enumerated exceptions to the warrant requirement in today’s guidance. The first is the traditional “exigent circumstances” exception, common to all warrant requirements and not particularly worrisome. But the second exception listed in today’s policy for undefined “exceptional circumstances” is potentially problematic. We have no idea what that means, so we’re waiting to see if and how the exception will be used.

What more is needed:

While we’re pleasantly surprised by this long-needed first step to bring Stingrays out of the shadows and into compliance with the Fourth Amendment’s warrant requirement, more is needed.

First and foremost, without a statute or court decision giving this voluntary policy the force of law, there will be no consequences if law enforcement agents flout its terms and continue using Stingrays as they have—without warrants. With only this policy shielding us, there’s nothing keeping warrantless Stingray evidence out of court, and therefore nothing to deter agents from behaving badly.

And finally, we need to extend this warrant requirement to all state and local law enforcement agencies around the country. Some states (such as Washington) already have such laws in place. It’s time to make the message clear to cops in all 50 states: if you want to use a Stingray, get a warrant!

This Labor Day weekend, EFF joins tens of thousands of sci-fi and fantasy fans at Dragon Con in Atlanta, Georgia. Our goal: educate and energize the fandoms about privacy, surveillance, and free speech. 

In addition to an epic cosplay activism campaign, our team is sitting on almost a dozen panels covering issues such as domestic surveillance and government transparency. At our table at the Hilton, we’ll be able to give you with practical tips for protecting your privacy using EFF’s Surveillance Self-Defense Project, and help you understand what types of technology police are using in your community, with some help from the Street Level Surveillance Project .

Just as we discussed San Diego’s surveillance camera network boondoggle (Voice of San Diego referred to it as “Bumbling Big Brother”) during Comic-Con 2014, here’s a quick round-up of some of the ways law enforcement in the Atlanta area are keeping an eye on you.

Automated License Plate Readers

Law enforcement agencies around the country have embraced Automated License Plate Readers (ALPRs), surveillance systems made up of network of cameras that capture the license plates of any vehicle that passes within view. Sometimes these cameras are attached to police vehicles, sometimes they’re mounted on telephone poles and traffic lights. While ALPR technology is often used to find stolen or wanted vehicles, it can also be used to identify witnesses, create lists of cars that frequent certain neighborhoods or establishments, and track the patterns of suspected criminal groups. When ALPR data is captured indiscriminately and stored for long periods of time, it can reveal the travel patterns of everyday drivers who aren’t suspected of crimes at all.

According to documents obtained by the ACLU of Georgia [PDF], the Atlanta Police Department invested more than $130,000 in ALPR technology in 2012, including at least 11 mobile cameras and one fixed-location camera.  The cameras were purchased from Vigilant Solutions, a company known for its aggressive marketing of the cameras and its immense database of ALPR data to law enforcement agencies around the country. 

In nearby Gwinett County, police began using ALPRs in 2011 at a cost of $20,000 per camera. The Atlanta Journal-Constitution further reports that the Georgia State Patrol and the Sandy Springs Police Department also use ALPRs. In Sandy Springs’ case, police told the reporter in 2012 that the agency’s one car-mounted ALPR system captured 11-million “reads” in a single year.

Stingrays

IMSI catchers—which go by brand names like “Stingrays” or “DRTBoxes—are devices that mimic cell phone towers in order to determine a cell phone’s location. These are among the more elusive surveillance tools used by law enforcement, since many agencies have signed non-disclosure agreements with the “Stingray” manufacturer, Harris Corp., which has resulted in evidence being withheld from defense attorneys and in some instances, criminal cases have been dropped for fear that the technology would be revealed.

Writing for TheBlot.com, Matthew Keys found that the Gwinett County Police spent roughly $200,000 on Stingrays, which a police spokesperson said the department uses “in criminal investigations with no restrictions on the type of crime.” The Gwinett County District Attorney further admitted on camera to an NBC investigative reporter that, pursuant to a secrecy provision within the county’s contracts with Harris, prosecutors do not disclose specifically the use of Stingrays to defense attorneys, instead only referring to the devices vaguely as “cellphone location technology.”

As of last year, Fulton County did not own its own Stingrays, but instead borrowed the devices from the U.S. Marshals, according to The Atlanta Voice.

Mobile Biometrics

Last month, EFF and MuckRock launched a campaign to file public-records requests around the country to expose how local law enforcement uses mobile devices during stops to capture biometric information, such as fingerprints, face recognition, and iris scans.  So far, we are still waiting on responses from several agencies in Georgia, including the Atlanta Police Department, Auburn Police Department, Bibb County Sheriff’s Office, and Lawrenceville Police Department.

Shockingly, the Georgia Bureau of Investigation (GBI) told us they were “unable to locate any records that are responsive to your request.” Apparently GBI didn’t search hard enough: a simple online search turns up many documents [PDF 1, 2] related to the bureau’s RapidID program, in which the state has funded the purchase of portable fingerprint scanners by local law enforcement.  The Georgia Department of Public Safety even has a formal “Mobile Biometrics” policy [PDF]. GBI’s most recent monthly report shows about 14,000 RapidID transactions in July 2015. 

Meanwhile, foreign travelers beware: in July 2015, Customs and Border Patrol launched a pilot project using mobile biometric devices at the Atlanta airport to capture thumbprints from foreign travelers as they leave the country. 

Hemisphere Project

Atlanta is a central location in the Hemisphere Project, a secret program that allows police to access a massive trove of call records going back decades maintained by AT&T. Funded by the White House’s Office of National Drug Control Policy, AT&T employees are placed in fusion centers to help police search the records.
However, police are told not to reveal the source of this evidence gathered through Hemisphere and instead are instructed to find another explanation for how they obtained the crime tip. The government calls this process “parallel construction.” We call it “intelligence laundering.”

There are Hemisphere hubs in Los Angeles, Houston, and Atlanta, the latter of which is run out of the Atlanta High Intensity Drug Trafficking Area (HIDTA) facilities.  According to public records, the Atlanta node processed 617 Hemisphere requests in 2012, representing 22% of all requests filed that year.

EFF has sued the California Department of Justice and the Drug Enforcement Agency under public records laws to obtain more information on the Hemisphere program. 

To learn more about local law enforcement technology, visit EFF’s Street Level Surveillance site. EFF Activist Nadia Kayyali and Investigative Researcher Dave Maass will discuss these issues more during the Electronics Frontiers Forum track at Dragon Con.  Check out the schedule.

The following is a guest post from Eric Crampton, Head of Research at the New Zealand Initiative, who previously served as Lecturer and Senior Lecturer in Economics at the Department of Economics & Finance at the University of Canterbury.

Australia National University’s Dr. George Barker suggested that New Zealand could do well by strengthening its copyright legislation. He warned against the fair dealing exceptions that have crept into the law and asked, “Why not have copyright law like property law—i.e. it lasts forever?” 

That is a good question. And it is an important one as New Zealand and other countries consider extending the term of copyright under the Trans-Pacific Partnership agreement. Current New Zealand law maintains copyright in written and artistic works for 50 years after the death of the writer. Copyright in film and sound recordings is shorter, lasting 50 years from the works being first made available. While the text of the TPP is not yet public, it appears that the agreement would extend copyright’s duration to 70 years from the death of the creator.

So why shouldn’t copyright be infinite?

Five years ago, Larrikin Music, who bought the rights to an old Australian folk song, sued Men At Work for including an 11-note flute sequence from it in their 80s-hit, “Down Under”. Where Men At Work had intended homage in its celebration of all things Australian, Larrikin, and the law, saw copyright infringement. 

But does that really go far enough? If an 11-note sequence counts as infringement, how much do modern artists owe Pachelbel’s descendants? The four-chord sequence making up the core of his Canon in D has been repeated in dozens, if not hundreds, of subsequent songs. Should evidence produced by Australia’s Axis of Awesome be used in copyright lawsuits by anyone who can document that, ten generations back, Johann Pachelbel was a great-great-grandfather? It seems absurd.

Even from the perspective of a profit-seeking artist, copyright is a double-edged sword. Stronger copyright both increases the rewards from having produced a piece of work and increases the cost of creating new works.

Too weak of copyright can mean that too few works are created, although artists have gotten far better at working out alternative ways of earning a living when, regardless of the letter of copyright law, enforcement has become difficult. Further, at standard time discounting rates, a 20-year extension to copyright’s term might provide only about a two percent increase in the value of any earned royalties. It is not particularly plausible that many new works would come into existence because of that slight increase.

On the other side, too strong of copyright can surely kill new creation. Artistic works feed off each other. New works build on older traditions, reinterpreting old folk tales and old folk tunes for new generations. The Brothers Grimm collected and published older folk tales like Cinderella and Sleeping Beauty in the 1800s. In the 1900s, Walt Disney brought those stories to life in a new form. In the 2000s, well, it is hard for new innovation to occur because copyright law, at least in the United States, has frozen the usage of most important works produced since 1923. An extension of copyright’s duration does far more to reward those who own the rights to existing works than it does to encourage new creation.

But, ultimately, why should copyright be limited? Because current creators draw on a global commons in their artistic creations, and future generations of artists deserve a commons too.

~

If you're Kiwi, ask your trade negotiator to stand firm and oppose the U.S. copyright term extension proposal in the TPP:

On our TPP's Copyright Trap page we link to more articles about how the threat of copyright term extension under the TPP impacts users around the world.